configure.ac

   1 # $Id$
   2 #
   3 # Copyright (c) 1999-2004 Damien Miller
   4 #
   5 # Permission to use, copy, modify, and distribute this software for any
   6 # purpose with or without fee is hereby granted, provided that the above
   7 # copyright notice and this permission notice appear in all copies.
   8 #
   9 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16
  17 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
  18 AC_REVISION($Revision$)
  19 AC_CONFIG_SRCDIR([ssh.c])
  20
  21 AC_CONFIG_HEADER(config.h)
  22 AC_PROG_CC
  23 AC_CANONICAL_HOST
  24 AC_C_BIGENDIAN
  25
  26 # Checks for programs.
  27 AC_PROG_AWK
  28 AC_PROG_CPP
  29 AC_PROG_RANLIB
  30 AC_PROG_INSTALL
  31 AC_PROG_EGREP
  32 AC_PATH_PROG(AR, ar)
  33 AC_PATH_PROG(CAT, cat)
  34 AC_PATH_PROG(KILL, kill)
  35 AC_PATH_PROGS(PERL, perl5 perl)
  36 AC_PATH_PROG(SED, sed)
  37 AC_SUBST(PERL)
  38 AC_PATH_PROG(ENT, ent)
  39 AC_SUBST(ENT)
  40 AC_PATH_PROG(TEST_MINUS_S_SH, bash)
  41 AC_PATH_PROG(TEST_MINUS_S_SH, ksh)
  42 AC_PATH_PROG(TEST_MINUS_S_SH, sh)
  43 AC_PATH_PROG(SH, sh)
  44 AC_SUBST(TEST_SHELL,sh)
  45
  46 dnl for buildpkg.sh
  47 AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd,
  48         [/usr/sbin${PATH_SEPARATOR}/etc])
  49 AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd,
  50         [/usr/sbin${PATH_SEPARATOR}/etc])
  51 AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no)
  52 if test -x /sbin/sh; then
  53         AC_SUBST(STARTUP_SCRIPT_SHELL,/sbin/sh)
  54 else
  55         AC_SUBST(STARTUP_SCRIPT_SHELL,/bin/sh)
  56 fi
  57
  58 # System features
  59 AC_SYS_LARGEFILE
  60
  61 if test -z "$AR" ; then
  62         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
  63 fi
  64
  65 # Use LOGIN_PROGRAM from environment if possible
  66 if test ! -z "$LOGIN_PROGRAM" ; then
  67         AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM",
  68                 [If your header files don't define LOGIN_PROGRAM,
  69                 then use this (detected) from environment and PATH])
  70 else
  71         # Search for login
  72         AC_PATH_PROG(LOGIN_PROGRAM_FALLBACK, login)
  73         if test ! -z "$LOGIN_PROGRAM_FALLBACK" ; then
  74                 AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM_FALLBACK")
  75         fi
  76 fi
  77
  78 AC_PATH_PROG(PATH_PASSWD_PROG, passwd)
  79 if test ! -z "$PATH_PASSWD_PROG" ; then
  80         AC_DEFINE_UNQUOTED(_PATH_PASSWD_PROG, "$PATH_PASSWD_PROG",
  81                 [Full path of your "passwd" program])
  82 fi
  83
  84 if test -z "$LD" ; then
  85         LD=$CC
  86 fi
  87 AC_SUBST(LD)
  88
  89 AC_C_INLINE
  90
  91 AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
  92
  93 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
  94         CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
  95         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
  96         case $GCC_VER in
  97                 1.*) no_attrib_nonnull=1 ;;
  98                 2.8* | 2.9*)
  99                      CFLAGS="$CFLAGS -Wsign-compare"
 100                      no_attrib_nonnull=1
 101                      ;;
 102                 2.*) no_attrib_nonnull=1 ;;
 103                 3.*) CFLAGS="$CFLAGS -Wsign-compare" ;;
 104                 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;;
 105                 *) ;;
 106         esac
 107
 108         AC_MSG_CHECKING(if $CC understands -fstack-protector-all)
 109         saved_CFLAGS="$CFLAGS"
 110         saved_LDFLAGS="$LDFLAGS"
 111         CFLAGS="$CFLAGS -fstack-protector-all"
 112         LDFLAGS="$LDFLAGS -fstack-protector-all"
 113         AC_TRY_LINK([], [ int main(void){return 0;} ],
 114             [ AC_MSG_RESULT(yes) ],
 115             [ AC_MSG_RESULT(no)
 116               CFLAGS="$saved_CFLAGS"
 117               LDFLAGS="$saved_LDFLAGS"
 118              ]
 119         )
 120
 121         if test -z "$have_llong_max"; then
 122                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 123                 unset ac_cv_have_decl_LLONG_MAX
 124                 saved_CFLAGS="$CFLAGS"
 125                 CFLAGS="$CFLAGS -std=gnu99"
 126                 AC_CHECK_DECL(LLONG_MAX,
 127                     [have_llong_max=1],
 128                     [CFLAGS="$saved_CFLAGS"],
 129                     [#include <limits.h>]
 130                 )
 131         fi
 132 fi
 133
 134 if test "x$no_attrib_nonnull" != "x1" ; then
 135         AC_DEFINE(HAVE_ATTRIBUTE__NONNULL__, 1, [Have attribute nonnull])
 136 fi
 137
 138 AC_ARG_WITH(rpath,
 139         [  --without-rpath         Disable auto-added -R linker paths],
 140         [
 141                 if test "x$withval" = "xno" ; then
 142                         need_dash_r=""
 143                 fi
 144                 if test "x$withval" = "xyes" ; then
 145                         need_dash_r=1
 146                 fi
 147         ]
 148 )
 149
 150 # Allow user to specify flags
 151 AC_ARG_WITH(cflags,
 152         [  --with-cflags           Specify additional flags to pass to compiler],
 153         [
 154                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 155                     test "x${withval}" != "xyes"; then
 156                         CFLAGS="$CFLAGS $withval"
 157                 fi
 158         ]
 159 )
 160 AC_ARG_WITH(cppflags,
 161         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 162         [
 163                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 164                     test "x${withval}" != "xyes"; then
 165                         CPPFLAGS="$CPPFLAGS $withval"
 166                 fi
 167         ]
 168 )
 169 AC_ARG_WITH(ldflags,
 170         [  --with-ldflags          Specify additional flags to pass to linker],
 171         [
 172                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 173                     test "x${withval}" != "xyes"; then
 174                         LDFLAGS="$LDFLAGS $withval"
 175                 fi
 176         ]
 177 )
 178 AC_ARG_WITH(libs,
 179         [  --with-libs             Specify additional libraries to link with],
 180         [
 181                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 182                     test "x${withval}" != "xyes"; then
 183                         LIBS="$LIBS $withval"
 184                 fi
 185         ]
 186 )
 187 AC_ARG_WITH(Werror,
 188         [  --with-Werror           Build main code with -Werror],
 189         [
 190                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 191                         werror_flags="-Werror"
 192                         if test "x${withval}" != "xyes"; then
 193                                 werror_flags="$withval"
 194                         fi
 195                 fi
 196         ]
 197 )
 198
 199 AC_CHECK_HEADERS( \
 200         bstring.h \
 201         crypt.h \
 202         crypto/sha2.h \
 203         dirent.h \
 204         endian.h \
 205         features.h \
 206         fcntl.h \
 207         floatingpoint.h \
 208         getopt.h \
 209         glob.h \
 210         ia.h \
 211         iaf.h \
 212         limits.h \
 213         login.h \
 214         maillock.h \
 215         ndir.h \
 216         net/if_tun.h \
 217         netdb.h \
 218         netgroup.h \
 219         pam/pam_appl.h \
 220         paths.h \
 221         poll.h \
 222         pty.h \
 223         readpassphrase.h \
 224         rpc/types.h \
 225         security/pam_appl.h \
 226         sha2.h \
 227         shadow.h \
 228         stddef.h \
 229         stdint.h \
 230         string.h \
 231         strings.h \
 232         sys/audit.h \
 233         sys/bitypes.h \
 234         sys/bsdtty.h \
 235         sys/cdefs.h \
 236         sys/dir.h \
 237         sys/mman.h \
 238         sys/ndir.h \
 239         sys/poll.h \
 240         sys/prctl.h \
 241         sys/pstat.h \
 242         sys/select.h \
 243         sys/stat.h \
 244         sys/stream.h \
 245         sys/stropts.h \
 246         sys/strtio.h \
 247         sys/sysmacros.h \
 248         sys/time.h \
 249         sys/timers.h \
 250         sys/un.h \
 251         time.h \
 252         tmpdir.h \
 253         ttyent.h \
 254         ucred.h \
 255         unistd.h \
 256         usersec.h \
 257         util.h \
 258         utime.h \
 259         utmp.h \
 260         utmpx.h \
 261         vis.h \
 262 )
 263
 264 # lastlog.h requires sys/time.h to be included first on Solaris
 265 AC_CHECK_HEADERS(lastlog.h, [], [], [
 266 #ifdef HAVE_SYS_TIME_H
 267 # include <sys/time.h>
 268 #endif
 269 ])
 270
 271 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 272 AC_CHECK_HEADERS(sys/ptms.h, [], [], [
 273 #ifdef HAVE_SYS_STREAM_H
 274 # include <sys/stream.h>
 275 #endif
 276 ])
 277
 278 # login_cap.h requires sys/types.h on NetBSD
 279 AC_CHECK_HEADERS(login_cap.h, [], [], [
 280 #include <sys/types.h>
 281 ])
 282
 283 # Messages for features tested for in target-specific section
 284 SIA_MSG="no"
 285 SPC_MSG="no"
 286
 287 # Check for some target-specific stuff
 288 case "$host" in
 289 *-*-aix*)
 290         # Some versions of VAC won't allow macro redefinitions at
 291         # -qlanglevel=ansi, and autoconf 2.60 sometimes insists on using that
 292         # particularly with older versions of vac or xlc.
 293         # It also throws errors about null macro argments, but these are
 294         # not fatal.
 295         AC_MSG_CHECKING(if compiler allows macro redefinitions)
 296         AC_COMPILE_IFELSE(
 297             [AC_LANG_SOURCE([[
 298 #define testmacro foo
 299 #define testmacro bar
 300 int main(void) { exit(0); }
 301             ]])],
 302             [ AC_MSG_RESULT(yes) ],
 303             [ AC_MSG_RESULT(no)
 304               CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
 305               LD="`echo $LD | sed 's/-qlanglvl\=ansi//g'`"
 306               CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 307               CPPFLAGS="`echo $CPPFLAGS | sed 's/-qlanglvl\=ansi//g'`"
 308             ]
 309         )
 310
 311         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 312         if (test -z "$blibpath"); then
 313                 blibpath="/usr/lib:/lib"
 314         fi
 315         saved_LDFLAGS="$LDFLAGS"
 316         if test "$GCC" = "yes"; then
 317                 flags="-Wl,-blibpath: -Wl,-rpath, -blibpath:"
 318         else
 319                 flags="-blibpath: -Wl,-blibpath: -Wl,-rpath,"
 320         fi
 321         for tryflags in $flags ;do
 322                 if (test -z "$blibflags"); then
 323                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 324                         AC_TRY_LINK([], [], [blibflags=$tryflags])
 325                 fi
 326         done
 327         if (test -z "$blibflags"); then
 328                 AC_MSG_RESULT(not found)
 329                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 330         else
 331                 AC_MSG_RESULT($blibflags)
 332         fi
 333         LDFLAGS="$saved_LDFLAGS"
 334         dnl Check for authenticate.  Might be in libs.a on older AIXes
 335         AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE, 1,
 336                 [Define if you want to enable AIX4's authenticate function])],
 337                 [AC_CHECK_LIB(s,authenticate,
 338                         [ AC_DEFINE(WITH_AIXAUTHENTICATE)
 339                                 LIBS="$LIBS -ls"
 340                         ])
 341                 ])
 342         dnl Check for various auth function declarations in headers.
 343         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 344             passwdexpired, setauthdb], , , [#include <usersec.h>])
 345         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 346         AC_CHECK_DECLS(loginfailed,
 347                  [AC_MSG_CHECKING(if loginfailed takes 4 arguments)
 348                   AC_TRY_COMPILE(
 349                         [#include <usersec.h>],
 350                         [(void)loginfailed("user","host","tty",0);],
 351                         [AC_MSG_RESULT(yes)
 352                          AC_DEFINE(AIX_LOGINFAILED_4ARG, 1,
 353                                 [Define if your AIX loginfailed() function
 354                                 takes 4 arguments (AIX >= 5.2)])],
 355                         [AC_MSG_RESULT(no)]
 356                 )],
 357                 [],
 358                 [#include <usersec.h>]
 359         )
 360         AC_CHECK_FUNCS(setauthdb)
 361         AC_CHECK_DECL(F_CLOSEM,
 362             AC_DEFINE(HAVE_FCNTL_CLOSEM, 1, [Use F_CLOSEM fcntl for closefrom]),
 363             [],
 364             [ #include <limits.h>
 365               #include <fcntl.h> ]
 366         )
 367         check_for_aix_broken_getaddrinfo=1
 368         AC_DEFINE(BROKEN_REALPATH, 1, [Define if you have a broken realpath.])
 369         AC_DEFINE(SETEUID_BREAKS_SETUID, 1,
 370             [Define if your platform breaks doing a seteuid before a setuid])
 371         AC_DEFINE(BROKEN_SETREUID, 1, [Define if your setreuid() is broken])
 372         AC_DEFINE(BROKEN_SETREGID, 1, [Define if your setregid() is broken])
 373         dnl AIX handles lastlog as part of its login message
 374         AC_DEFINE(DISABLE_LASTLOG, 1, [Define if you don't want to use lastlog])
 375         AC_DEFINE(LOGIN_NEEDS_UTMPX, 1,
 376                 [Some systems need a utmpx entry for /bin/login to work])
 377         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV,
 378                 [Define to a Set Process Title type if your system is
 379                 supported by bsd-setproctitle.c])
 380         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 381             [AIX 5.2 and 5.3 (and presumably newer) require this])
 382         AC_DEFINE(PTY_ZEROREAD, 1, [read(1) can return 0 for a non-closed fd])
 383         ;;
 384 *-*-cygwin*)
 385         check_for_libcrypt_later=1
 386         LIBS="$LIBS /usr/lib/textreadmode.o"
 387         AC_DEFINE(HAVE_CYGWIN, 1, [Define if you are on Cygwin])
 388         AC_DEFINE(USE_PIPES, 1, [Use PIPES instead of a socketpair()])
 389         AC_DEFINE(DISABLE_SHADOW, 1,
 390                 [Define if you want to disable shadow passwords])
 391         AC_DEFINE(IP_TOS_IS_BROKEN, 1,
 392                 [Define if your system choked on IP TOS setting])
 393         AC_DEFINE(NO_X11_UNIX_SOCKETS, 1,
 394                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 395         AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT, 1,
 396                 [Define if the concept of ports only accessible to
 397                 superusers isn't known])
 398         AC_DEFINE(DISABLE_FD_PASSING, 1,
 399                 [Define if your platform needs to skip post auth
 400                 file descriptor passing])
 401         ;;
 402 *-*-dgux*)
 403         AC_DEFINE(IP_TOS_IS_BROKEN)
 404         AC_DEFINE(SETEUID_BREAKS_SETUID)
 405         AC_DEFINE(BROKEN_SETREUID)
 406         AC_DEFINE(BROKEN_SETREGID)
 407         ;;
 408 *-*-darwin*)
 409         AC_MSG_CHECKING(if we have working getaddrinfo)
 410         AC_TRY_RUN([#include <mach-o/dyld.h>
 411 main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 412                 exit(0);
 413         else
 414                 exit(1);
 415 }], [AC_MSG_RESULT(working)],
 416         [AC_MSG_RESULT(buggy)
 417         AC_DEFINE(BROKEN_GETADDRINFO, 1, [getaddrinfo is broken (if present)])],
 418         [AC_MSG_RESULT(assume it is working)])
 419         AC_DEFINE(SETEUID_BREAKS_SETUID)
 420         AC_DEFINE(BROKEN_SETREUID)
 421         AC_DEFINE(BROKEN_SETREGID)
 422         AC_DEFINE(BROKEN_GLOB, 1, [OS X glob does not do what we expect])
 423         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
 424                 [Define if your resolver libs need this for getrrsetbyname])
 425         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 426         AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 427             [Use tunnel device compatibility to OpenBSD])
 428         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 429             [Prepend the address family to IP tunnel traffic])
 430         m4_pattern_allow(AU_IPv)
 431         AC_CHECK_DECL(AU_IPv4, [],
 432             AC_DEFINE(AU_IPv4, 0, [System only supports IPv4 audit records])
 433             [#include <bsm/audit.h>]
 434         )
 435         ;;
 436 *-*-dragonfly*)
 437         SSHDLIBS="$SSHDLIBS -lcrypt"
 438         ;;
 439 *-*-hpux*)
 440         # first we define all of the options common to all HP-UX releases
 441         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 442         IPADDR_IN_DISPLAY=yes
 443         AC_DEFINE(USE_PIPES)
 444         AC_DEFINE(LOGIN_NO_ENDOPT, 1,
 445             [Define if your login program cannot handle end of options ("--")])
 446         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 447         AC_DEFINE(LOCKED_PASSWD_STRING, "*",
 448                 [String used in /etc/passwd to denote locked account])
 449         AC_DEFINE(SPT_TYPE,SPT_PSTAT)
 450         MAIL="/var/mail/username"
 451         LIBS="$LIBS -lsec"
 452         AC_CHECK_LIB(xnet, t_error, ,
 453             AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
 454
 455         # next, we define all of the options specific to major releases
 456         case "$host" in
 457         *-*-hpux10*)
 458                 if test -z "$GCC"; then
 459                         CFLAGS="$CFLAGS -Ae"
 460                 fi
 461                 ;;
 462         *-*-hpux11*)
 463                 AC_DEFINE(PAM_SUN_CODEBASE, 1,
 464                         [Define if you are using Solaris-derived PAM which
 465                         passes pam_messages to the conversation function
 466                         with an extra level of indirection])
 467                 AC_DEFINE(DISABLE_UTMP, 1,
 468                         [Define if you don't want to use utmp])
 469                 AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
 470                 check_for_hpux_broken_getaddrinfo=1
 471                 check_for_conflicting_getspnam=1
 472                 ;;
 473         esac
 474
 475         # lastly, we define options specific to minor releases
 476         case "$host" in
 477         *-*-hpux10.26)
 478                 AC_DEFINE(HAVE_SECUREWARE, 1,
 479                         [Define if you have SecureWare-based
 480                         protected password database])
 481                 disable_ptmx_check=yes
 482                 LIBS="$LIBS -lsecpw"
 483                 ;;
 484         esac
 485         ;;
 486 *-*-irix5*)
 487         PATH="$PATH:/usr/etc"
 488         AC_DEFINE(BROKEN_INET_NTOA, 1,
 489                 [Define if you system's inet_ntoa is busted
 490                 (e.g. Irix gcc issue)])
 491         AC_DEFINE(SETEUID_BREAKS_SETUID)
 492         AC_DEFINE(BROKEN_SETREUID)
 493         AC_DEFINE(BROKEN_SETREGID)
 494         AC_DEFINE(WITH_ABBREV_NO_TTY, 1,
 495                 [Define if you shouldn't strip 'tty' from your
 496                 ttyname in [uw]tmp])
 497         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 498         ;;
 499 *-*-irix6*)
 500         PATH="$PATH:/usr/etc"
 501         AC_DEFINE(WITH_IRIX_ARRAY, 1,
 502                 [Define if you have/want arrays
 503                 (cluster-wide session managment, not C arrays)])
 504         AC_DEFINE(WITH_IRIX_PROJECT, 1,
 505                 [Define if you want IRIX project management])
 506         AC_DEFINE(WITH_IRIX_AUDIT, 1,
 507                 [Define if you want IRIX audit trails])
 508         AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS, 1,
 509                 [Define if you want IRIX kernel jobs])])
 510         AC_DEFINE(BROKEN_INET_NTOA)
 511         AC_DEFINE(SETEUID_BREAKS_SETUID)
 512         AC_DEFINE(BROKEN_SETREUID)
 513         AC_DEFINE(BROKEN_SETREGID)
 514         AC_DEFINE(BROKEN_UPDWTMPX, 1, [updwtmpx is broken (if present)])
 515         AC_DEFINE(WITH_ABBREV_NO_TTY)
 516         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 517         ;;
 518 *-*-linux*)
 519         no_dev_ptmx=1
 520         check_for_libcrypt_later=1
 521         check_for_openpty_ctty_bug=1
 522         AC_DEFINE(DONT_TRY_OTHER_AF, 1, [Workaround more Linux IPv6 quirks])
 523         AC_DEFINE(PAM_TTY_KLUDGE, 1,
 524                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 525         AC_DEFINE(LOCKED_PASSWD_PREFIX, "!",
 526                 [String used in /etc/passwd to denote locked account])
 527         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
 528         AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM,
 529                 [Define to whatever link() returns for "not supported"
 530                 if it doesn't return EOPNOTSUPP.])
 531         AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
 532         AC_DEFINE(USE_BTMP)
 533         inet6_default_4in6=yes
 534         case `uname -r` in
 535         1.*|2.0.*)
 536                 AC_DEFINE(BROKEN_CMSG_TYPE, 1,
 537                         [Define if cmsg_type is not passed correctly])
 538                 ;;
 539         esac
 540         # tun(4) forwarding compat code
 541         AC_CHECK_HEADERS(linux/if_tun.h)
 542         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 543                 AC_DEFINE(SSH_TUN_LINUX, 1,
 544                     [Open tunnel devices the Linux tun/tap way])
 545                 AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 546                     [Use tunnel device compatibility to OpenBSD])
 547                 AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 548                     [Prepend the address family to IP tunnel traffic])
 549         fi
 550         ;;
 551 mips-sony-bsd|mips-sony-newsos4)
 552         AC_DEFINE(NEED_SETPGRP, 1, [Need setpgrp to acquire controlling tty])
 553         SONY=1
 554         ;;
 555 *-*-netbsd*)
 556         check_for_libcrypt_before=1
 557         if test "x$withval" != "xno" ; then
 558                 need_dash_r=1
 559         fi
 560         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 561         AC_CHECK_HEADER([net/if_tap.h], ,
 562             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 563         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 564             [Prepend the address family to IP tunnel traffic])
 565         ;;
 566 *-*-freebsd*)
 567         check_for_libcrypt_later=1
 568         AC_DEFINE(LOCKED_PASSWD_PREFIX, "*LOCKED*", [Account locked with pw(1)])
 569         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 570         AC_CHECK_HEADER([net/if_tap.h], ,
 571             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 572         ;;
 573 *-*-bsdi*)
 574         AC_DEFINE(SETEUID_BREAKS_SETUID)
 575         AC_DEFINE(BROKEN_SETREUID)
 576         AC_DEFINE(BROKEN_SETREGID)
 577         ;;
 578 *-next-*)
 579         conf_lastlog_location="/usr/adm/lastlog"
 580         conf_utmp_location=/etc/utmp
 581         conf_wtmp_location=/usr/adm/wtmp
 582         MAIL=/usr/spool/mail
 583         AC_DEFINE(HAVE_NEXT, 1, [Define if you are on NeXT])
 584         AC_DEFINE(BROKEN_REALPATH)
 585         AC_DEFINE(USE_PIPES)
 586         AC_DEFINE(BROKEN_SAVED_UIDS, 1, [Needed for NeXT])
 587         ;;
 588 *-*-openbsd*)
 589         AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
 590         AC_DEFINE(HAVE_ATTRIBUTE__BOUNDED__, 1, [OpenBSD's gcc has bounded])
 591         AC_DEFINE(SSH_TUN_OPENBSD, 1, [Open tunnel devices the OpenBSD way])
 592         AC_DEFINE(SYSLOG_R_SAFE_IN_SIGHAND, 1,
 593             [syslog_r function is safe to use in in a signal handler])
 594         ;;
 595 *-*-solaris*)
 596         if test "x$withval" != "xno" ; then
 597                 need_dash_r=1
 598         fi
 599         AC_DEFINE(PAM_SUN_CODEBASE)
 600         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 601         AC_DEFINE(LOGIN_NEEDS_TERM, 1,
 602                 [Some versions of /bin/login need the TERM supplied
 603                 on the commandline])
 604         AC_DEFINE(PAM_TTY_KLUDGE)
 605         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 606                 [Define if pam_chauthtok wants real uid set
 607                 to the unpriv'ed user])
 608         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 609         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 610         AC_DEFINE(SSHD_ACQUIRES_CTTY, 1,
 611                 [Define if sshd somehow reacquires a controlling TTY
 612                 after setsid()])
 613         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd
 614                 in case the name is longer than 8 chars])
 615         external_path_file=/etc/default/login
 616         # hardwire lastlog location (can't detect it on some versions)
 617         conf_lastlog_location="/var/adm/lastlog"
 618         AC_MSG_CHECKING(for obsolete utmp and wtmp in solaris2.x)
 619         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 620         if test "$sol2ver" -ge 8; then
 621                 AC_MSG_RESULT(yes)
 622                 AC_DEFINE(DISABLE_UTMP)
 623                 AC_DEFINE(DISABLE_WTMP, 1,
 624                         [Define if you don't want to use wtmp])
 625         else
 626                 AC_MSG_RESULT(no)
 627         fi
 628         AC_ARG_WITH(solaris-contracts,
 629                 [  --with-solaris-contracts Enable Solaris process contracts (experimental)],
 630                 [
 631                 AC_CHECK_LIB(contract, ct_tmpl_activate,
 632                         [ AC_DEFINE(USE_SOLARIS_PROCESS_CONTRACTS, 1,
 633                                 [Define if you have Solaris process contracts])
 634                           SSHDLIBS="$SSHDLIBS -lcontract"
 635                           AC_SUBST(SSHDLIBS)
 636                           SPC_MSG="yes" ], )
 637                 ],
 638         )
 639         ;;
 640 *-*-sunos4*)
 641         CPPFLAGS="$CPPFLAGS -DSUNOS4"
 642         AC_CHECK_FUNCS(getpwanam)
 643         AC_DEFINE(PAM_SUN_CODEBASE)
 644         conf_utmp_location=/etc/utmp
 645         conf_wtmp_location=/var/adm/wtmp
 646         conf_lastlog_location=/var/adm/lastlog
 647         AC_DEFINE(USE_PIPES)
 648         ;;
 649 *-ncr-sysv*)
 650         LIBS="$LIBS -lc89"
 651         AC_DEFINE(USE_PIPES)
 652         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 653         AC_DEFINE(SETEUID_BREAKS_SETUID)
 654         AC_DEFINE(BROKEN_SETREUID)
 655         AC_DEFINE(BROKEN_SETREGID)
 656         ;;
 657 *-sni-sysv*)
 658         # /usr/ucblib MUST NOT be searched on ReliantUNIX
 659         AC_CHECK_LIB(dl, dlsym, ,)
 660         # -lresolv needs to be at the end of LIBS or DNS lookups break
 661         AC_CHECK_LIB(resolv, res_query, [ LIBS="$LIBS -lresolv" ])
 662         IPADDR_IN_DISPLAY=yes
 663         AC_DEFINE(USE_PIPES)
 664         AC_DEFINE(IP_TOS_IS_BROKEN)
 665         AC_DEFINE(SETEUID_BREAKS_SETUID)
 666         AC_DEFINE(BROKEN_SETREUID)
 667         AC_DEFINE(BROKEN_SETREGID)
 668         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 669         external_path_file=/etc/default/login
 670         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
 671         # Attention: always take care to bind libsocket and libnsl before libc,
 672         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
 673         ;;
 674 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 675 *-*-sysv4.2*)
 676         AC_DEFINE(USE_PIPES)
 677         AC_DEFINE(SETEUID_BREAKS_SETUID)
 678         AC_DEFINE(BROKEN_SETREUID)
 679         AC_DEFINE(BROKEN_SETREGID)
 680         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
 681         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 682         ;;
 683 # UnixWare 7.x, OpenUNIX 8
 684 *-*-sysv5*)
 685         check_for_libcrypt_later=1
 686         AC_DEFINE(UNIXWARE_LONG_PASSWORDS, 1, [Support passwords > 8 chars])
 687         AC_DEFINE(USE_PIPES)
 688         AC_DEFINE(SETEUID_BREAKS_SETUID)
 689         AC_DEFINE(BROKEN_SETREUID)
 690         AC_DEFINE(BROKEN_SETREGID)
 691         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 692         case "$host" in
 693         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
 694                 TEST_SHELL=/u95/bin/sh
 695                 AC_DEFINE(BROKEN_LIBIAF, 1,
 696                         [ia_uinfo routines not supported by OS yet])
 697                 AC_DEFINE(BROKEN_UPDWTMPX)
 698                 ;;
 699         *)      AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 700                 ;;
 701         esac
 702         ;;
 703 *-*-sysv*)
 704         ;;
 705 # SCO UNIX and OEM versions of SCO UNIX
 706 *-*-sco3.2v4*)
 707         AC_MSG_ERROR("This Platform is no longer supported.")
 708         ;;
 709 # SCO OpenServer 5.x
 710 *-*-sco3.2v5*)
 711         if test -z "$GCC"; then
 712                 CFLAGS="$CFLAGS -belf"
 713         fi
 714         LIBS="$LIBS -lprot -lx -ltinfo -lm"
 715         no_dev_ptmx=1
 716         AC_DEFINE(USE_PIPES)
 717         AC_DEFINE(HAVE_SECUREWARE)
 718         AC_DEFINE(DISABLE_SHADOW)
 719         AC_DEFINE(DISABLE_FD_PASSING)
 720         AC_DEFINE(SETEUID_BREAKS_SETUID)
 721         AC_DEFINE(BROKEN_SETREUID)
 722         AC_DEFINE(BROKEN_SETREGID)
 723         AC_DEFINE(WITH_ABBREV_NO_TTY)
 724         AC_DEFINE(BROKEN_UPDWTMPX)
 725         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 726         AC_CHECK_FUNCS(getluid setluid)
 727         MANTYPE=man
 728         TEST_SHELL=ksh
 729         ;;
 730 *-*-unicosmk*)
 731         AC_DEFINE(NO_SSH_LASTLOG, 1,
 732                 [Define if you don't want to use lastlog in session.c])
 733         AC_DEFINE(SETEUID_BREAKS_SETUID)
 734         AC_DEFINE(BROKEN_SETREUID)
 735         AC_DEFINE(BROKEN_SETREGID)
 736         AC_DEFINE(USE_PIPES)
 737         AC_DEFINE(DISABLE_FD_PASSING)
 738         LDFLAGS="$LDFLAGS"
 739         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 740         MANTYPE=cat
 741         ;;
 742 *-*-unicosmp*)
 743         AC_DEFINE(SETEUID_BREAKS_SETUID)
 744         AC_DEFINE(BROKEN_SETREUID)
 745         AC_DEFINE(BROKEN_SETREGID)
 746         AC_DEFINE(WITH_ABBREV_NO_TTY)
 747         AC_DEFINE(USE_PIPES)
 748         AC_DEFINE(DISABLE_FD_PASSING)
 749         LDFLAGS="$LDFLAGS"
 750         LIBS="$LIBS -lgen -lacid -ldb"
 751         MANTYPE=cat
 752         ;;
 753 *-*-unicos*)
 754         AC_DEFINE(SETEUID_BREAKS_SETUID)
 755         AC_DEFINE(BROKEN_SETREUID)
 756         AC_DEFINE(BROKEN_SETREGID)
 757         AC_DEFINE(USE_PIPES)
 758         AC_DEFINE(DISABLE_FD_PASSING)
 759         AC_DEFINE(NO_SSH_LASTLOG)
 760         LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
 761         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 762         MANTYPE=cat
 763         ;;
 764 *-dec-osf*)
 765         AC_MSG_CHECKING(for Digital Unix SIA)
 766         no_osfsia=""
 767         AC_ARG_WITH(osfsia,
 768                 [  --with-osfsia           Enable Digital Unix SIA],
 769                 [
 770                         if test "x$withval" = "xno" ; then
 771                                 AC_MSG_RESULT(disabled)
 772                                 no_osfsia=1
 773                         fi
 774                 ],
 775         )
 776         if test -z "$no_osfsia" ; then
 777                 if test -f /etc/sia/matrix.conf; then
 778                         AC_MSG_RESULT(yes)
 779                         AC_DEFINE(HAVE_OSF_SIA, 1,
 780                                 [Define if you have Digital Unix Security
 781                                 Integration Architecture])
 782                         AC_DEFINE(DISABLE_LOGIN, 1,
 783                                 [Define if you don't want to use your
 784                                 system's login() call])
 785                         AC_DEFINE(DISABLE_FD_PASSING)
 786                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
 787                         SIA_MSG="yes"
 788                 else
 789                         AC_MSG_RESULT(no)
 790                         AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin",
 791                           [String used in /etc/passwd to denote locked account])
 792                 fi
 793         fi
 794         AC_DEFINE(BROKEN_GETADDRINFO)
 795         AC_DEFINE(SETEUID_BREAKS_SETUID)
 796         AC_DEFINE(BROKEN_SETREUID)
 797         AC_DEFINE(BROKEN_SETREGID)
 798         ;;
 799
 800 *-*-nto-qnx*)
 801         AC_DEFINE(USE_PIPES)
 802         AC_DEFINE(NO_X11_UNIX_SOCKETS)
 803         AC_DEFINE(MISSING_NFDBITS, 1, [Define on *nto-qnx systems])
 804         AC_DEFINE(MISSING_HOWMANY, 1, [Define on *nto-qnx systems])
 805         AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
 806         AC_DEFINE(DISABLE_LASTLOG)
 807         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 808         AC_DEFINE(BROKEN_SHADOW_EXPIRE, 1, [QNX shadow support is broken])
 809         enable_etc_default_login=no     # has incompatible /etc/default/login
 810         case "$host" in
 811         *-*-nto-qnx6*)
 812                 AC_DEFINE(DISABLE_FD_PASSING)
 813                 ;;
 814         esac
 815         ;;
 816
 817 *-*-ultrix*)
 818         AC_DEFINE(BROKEN_GETGROUPS, 1, [getgroups(0,NULL) will return -1])
 819         AC_DEFINE(BROKEN_MMAP, 1, [Ultrix mmap can't map files])
 820         AC_DEFINE(NEED_SETPGRP)
 821         AC_DEFINE(HAVE_SYS_SYSLOG_H, 1, [Force use of sys/syslog.h on Ultrix])
 822         ;;
 823
 824 *-*-lynxos)
 825         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
 826         AC_DEFINE(MISSING_HOWMANY)
 827         AC_DEFINE(BROKEN_SETVBUF, 1, [LynxOS has broken setvbuf() implementation])
 828         ;;
 829 esac
 830
 831 AC_MSG_CHECKING(compiler and flags for sanity)
 832 AC_RUN_IFELSE(
 833         [AC_LANG_SOURCE([
 834 #include <stdio.h>
 835 int main(){exit(0);}
 836         ])],
 837         [       AC_MSG_RESULT(yes) ],
 838         [
 839                 AC_MSG_RESULT(no)
 840                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
 841         ],
 842         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
 843 )
 844
 845 dnl Checks for header files.
 846 # Checks for libraries.
 847 AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
 848 AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt))
 849
 850 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
 851 AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
 852         AC_CHECK_LIB(gen, dirname,[
 853                 AC_CACHE_CHECK([for broken dirname],
 854                         ac_cv_have_broken_dirname, [
 855                         save_LIBS="$LIBS"
 856                         LIBS="$LIBS -lgen"
 857                         AC_RUN_IFELSE(
 858                                 [AC_LANG_SOURCE([[
 859 #include <libgen.h>
 860 #include <string.h>
 861
 862 int main(int argc, char **argv) {
 863     char *s, buf[32];
 864
 865     strncpy(buf,"/etc", 32);
 866     s = dirname(buf);
 867     if (!s || strncmp(s, "/", 32) != 0) {
 868         exit(1);
 869     } else {
 870         exit(0);
 871     }
 872 }
 873                                 ]])],
 874                                 [ ac_cv_have_broken_dirname="no" ],
 875                                 [ ac_cv_have_broken_dirname="yes" ],
 876                                 [ ac_cv_have_broken_dirname="no" ],
 877                         )
 878                         LIBS="$save_LIBS"
 879                 ])
 880                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
 881                         LIBS="$LIBS -lgen"
 882                         AC_DEFINE(HAVE_DIRNAME)
 883                         AC_CHECK_HEADERS(libgen.h)
 884                 fi
 885         ])
 886 ])
 887
 888 AC_CHECK_FUNC(getspnam, ,
 889         AC_CHECK_LIB(gen, getspnam, LIBS="$LIBS -lgen"))
 890 AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME, 1,
 891         [Define if you have the basename function.]))
 892
 893 dnl zlib is required
 894 AC_ARG_WITH(zlib,
 895         [  --with-zlib=PATH        Use zlib in PATH],
 896         [ if test "x$withval" = "xno" ; then
 897                 AC_MSG_ERROR([*** zlib is required ***])
 898           elif test "x$withval" != "xyes"; then
 899                 if test -d "$withval/lib"; then
 900                         if test -n "${need_dash_r}"; then
 901                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
 902                         else
 903                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
 904                         fi
 905                 else
 906                         if test -n "${need_dash_r}"; then
 907                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
 908                         else
 909                                 LDFLAGS="-L${withval} ${LDFLAGS}"
 910                         fi
 911                 fi
 912                 if test -d "$withval/include"; then
 913                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
 914                 else
 915                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
 916                 fi
 917         fi ]
 918 )
 919
 920 AC_CHECK_LIB(z, deflate, ,
 921         [
 922                 saved_CPPFLAGS="$CPPFLAGS"
 923                 saved_LDFLAGS="$LDFLAGS"
 924                 save_LIBS="$LIBS"
 925                 dnl Check default zlib install dir
 926                 if test -n "${need_dash_r}"; then
 927                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
 928                 else
 929                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
 930                 fi
 931                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
 932                 LIBS="$LIBS -lz"
 933                 AC_TRY_LINK_FUNC(deflate, AC_DEFINE(HAVE_LIBZ),
 934                         [
 935                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
 936                         ]
 937                 )
 938         ]
 939 )
 940 AC_CHECK_HEADER([zlib.h], ,AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***]))
 941
 942 AC_ARG_WITH(zlib-version-check,
 943         [  --without-zlib-version-check Disable zlib version check],
 944         [  if test "x$withval" = "xno" ; then
 945                 zlib_check_nonfatal=1
 946            fi
 947         ]
 948 )
 949
 950 AC_MSG_CHECKING(for possibly buggy zlib)
 951 AC_RUN_IFELSE([AC_LANG_SOURCE([[
 952 #include <stdio.h>
 953 #include <zlib.h>
 954 int main()
 955 {
 956         int a=0, b=0, c=0, d=0, n, v;
 957         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
 958         if (n != 3 && n != 4)
 959                 exit(1);
 960         v = a*1000000 + b*10000 + c*100 + d;
 961         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
 962
 963         /* 1.1.4 is OK */
 964         if (a == 1 && b == 1 && c >= 4)
 965                 exit(0);
 966
 967         /* 1.2.3 and up are OK */
 968         if (v >= 1020300)
 969                 exit(0);
 970
 971         exit(2);
 972 }
 973         ]])],
 974         AC_MSG_RESULT(no),
 975         [ AC_MSG_RESULT(yes)
 976           if test -z "$zlib_check_nonfatal" ; then
 977                 AC_MSG_ERROR([*** zlib too old - check config.log ***
 978 Your reported zlib version has known security problems.  It's possible your
 979 vendor has fixed these problems without changing the version number.  If you
 980 are sure this is the case, you can disable the check by running
 981 "./configure --without-zlib-version-check".
 982 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
 983 See http://www.gzip.org/zlib/ for details.])
 984           else
 985                 AC_MSG_WARN([zlib version may have security problems])
 986           fi
 987         ],
 988         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
 989 )
 990
 991 dnl UnixWare 2.x
 992 AC_CHECK_FUNC(strcasecmp,
 993         [], [ AC_CHECK_LIB(resolv, strcasecmp, LIBS="$LIBS -lresolv") ]
 994 )
 995 AC_CHECK_FUNCS(utimes,
 996         [], [ AC_CHECK_LIB(c89, utimes, [AC_DEFINE(HAVE_UTIMES)
 997                                         LIBS="$LIBS -lc89"]) ]
 998 )
 999
1000 dnl    Checks for libutil functions
1001 AC_CHECK_HEADERS(libutil.h)
1002 AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1,
1003         [Define if your libraries define login()])])
1004 AC_CHECK_FUNCS(logout updwtmp logwtmp)
1005
1006 AC_FUNC_STRFTIME
1007
1008 # Check for ALTDIRFUNC glob() extension
1009 AC_MSG_CHECKING(for GLOB_ALTDIRFUNC support)
1010 AC_EGREP_CPP(FOUNDIT,
1011         [
1012                 #include <glob.h>
1013                 #ifdef GLOB_ALTDIRFUNC
1014                 FOUNDIT
1015                 #endif
1016         ],
1017         [
1018                 AC_DEFINE(GLOB_HAS_ALTDIRFUNC, 1,
1019                         [Define if your system glob() function has
1020                         the GLOB_ALTDIRFUNC extension])
1021                 AC_MSG_RESULT(yes)
1022         ],
1023         [
1024                 AC_MSG_RESULT(no)
1025         ]
1026 )
1027
1028 # Check for g.gl_matchc glob() extension
1029 AC_MSG_CHECKING(for gl_matchc field in glob_t)
1030 AC_TRY_COMPILE(
1031         [ #include <glob.h> ],
1032         [glob_t g; g.gl_matchc = 1;],
1033         [
1034                 AC_DEFINE(GLOB_HAS_GL_MATCHC, 1,
1035                         [Define if your system glob() function has
1036                         gl_matchc options in glob_t])
1037                 AC_MSG_RESULT(yes)
1038         ],
1039         [
1040                 AC_MSG_RESULT(no)
1041         ]
1042 )
1043
1044 AC_CHECK_DECLS(GLOB_NOMATCH, , , [#include <glob.h>])
1045
1046 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
1047 AC_RUN_IFELSE(
1048         [AC_LANG_SOURCE([[
1049 #include <sys/types.h>
1050 #include <dirent.h>
1051 int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
1052         ]])],
1053         [AC_MSG_RESULT(yes)],
1054         [
1055                 AC_MSG_RESULT(no)
1056                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME, 1,
1057                         [Define if your struct dirent expects you to
1058                         allocate extra space for d_name])
1059         ],
1060         [
1061                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
1062                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
1063         ]
1064 )
1065
1066 AC_MSG_CHECKING([for /proc/pid/fd directory])
1067 if test -d "/proc/$$/fd" ; then
1068         AC_DEFINE(HAVE_PROC_PID, 1, [Define if you have /proc/$pid/fd])
1069         AC_MSG_RESULT(yes)
1070 else
1071         AC_MSG_RESULT(no)
1072 fi
1073
1074 # Check whether user wants S/Key support
1075 SKEY_MSG="no"
1076 AC_ARG_WITH(skey,
1077         [  --with-skey[[=PATH]]      Enable S/Key support (optionally in PATH)],
1078         [
1079                 if test "x$withval" != "xno" ; then
1080
1081                         if test "x$withval" != "xyes" ; then
1082                                 CPPFLAGS="$CPPFLAGS -I${withval}/include"
1083                                 LDFLAGS="$LDFLAGS -L${withval}/lib"
1084                         fi
1085
1086                         AC_DEFINE(SKEY, 1, [Define if you want S/Key support])
1087                         LIBS="-lskey $LIBS"
1088                         SKEY_MSG="yes"
1089
1090                         AC_MSG_CHECKING([for s/key support])
1091                         AC_LINK_IFELSE(
1092                                 [AC_LANG_SOURCE([[
1093 #include <stdio.h>
1094 #include <skey.h>
1095 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
1096                                 ]])],
1097                                 [AC_MSG_RESULT(yes)],
1098                                 [
1099                                         AC_MSG_RESULT(no)
1100                                         AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
1101                                 ])
1102                         AC_MSG_CHECKING(if skeychallenge takes 4 arguments)
1103                         AC_TRY_COMPILE(
1104                                 [#include <stdio.h>
1105                                  #include <skey.h>],
1106                                 [(void)skeychallenge(NULL,"name","",0);],
1107                                 [AC_MSG_RESULT(yes)
1108                                  AC_DEFINE(SKEYCHALLENGE_4ARG, 1,
1109                                         [Define if your skeychallenge()
1110                                         function takes 4 arguments (NetBSD)])],
1111                                 [AC_MSG_RESULT(no)]
1112                         )
1113                 fi
1114         ]
1115 )
1116
1117 # Check whether user wants TCP wrappers support
1118 TCPW_MSG="no"
1119 AC_ARG_WITH(tcp-wrappers,
1120         [  --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1121         [
1122                 if test "x$withval" != "xno" ; then
1123                         saved_LIBS="$LIBS"
1124                         saved_LDFLAGS="$LDFLAGS"
1125                         saved_CPPFLAGS="$CPPFLAGS"
1126                         if test -n "${withval}" && \
1127                             test "x${withval}" != "xyes"; then
1128                                 if test -d "${withval}/lib"; then
1129                                         if test -n "${need_dash_r}"; then
1130                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1131                                         else
1132                                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1133                                         fi
1134                                 else
1135                                         if test -n "${need_dash_r}"; then
1136                                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1137                                         else
1138                                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1139                                         fi
1140                                 fi
1141                                 if test -d "${withval}/include"; then
1142                                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1143                                 else
1144                                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1145                                 fi
1146                         fi
1147                         LIBS="-lwrap $LIBS"
1148                         AC_MSG_CHECKING(for libwrap)
1149                         AC_TRY_LINK(
1150                                 [
1151 #include <sys/types.h>
1152 #include <sys/socket.h>
1153 #include <netinet/in.h>
1154 #include <tcpd.h>
1155                                         int deny_severity = 0, allow_severity = 0;
1156                                 ],
1157                                 [hosts_access(0);],
1158                                 [
1159                                         AC_MSG_RESULT(yes)
1160                                         AC_DEFINE(LIBWRAP, 1,
1161                                                 [Define if you want
1162                                                 TCP Wrappers support])
1163                                         SSHDLIBS="$SSHDLIBS -lwrap"
1164                                         TCPW_MSG="yes"
1165                                 ],
1166                                 [
1167                                         AC_MSG_ERROR([*** libwrap missing])
1168                                 ]
1169                         )
1170                         LIBS="$saved_LIBS"
1171                 fi
1172         ]
1173 )
1174
1175 # Check whether user wants libedit support
1176 LIBEDIT_MSG="no"
1177 AC_ARG_WITH(libedit,
1178         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1179         [ if test "x$withval" != "xno" ; then
1180                 if test "x$withval" != "xyes"; then
1181                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1182                         if test -n "${need_dash_r}"; then
1183                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1184                         else
1185                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1186                         fi
1187                 fi
1188                 AC_CHECK_LIB(edit, el_init,
1189                         [ AC_DEFINE(USE_LIBEDIT, 1, [Use libedit for sftp])
1190                           LIBEDIT="-ledit -lcurses"
1191                           LIBEDIT_MSG="yes"
1192                           AC_SUBST(LIBEDIT)
1193                         ],
1194                         [ AC_MSG_ERROR(libedit not found) ],
1195                         [ -lcurses ]
1196                 )
1197                 AC_MSG_CHECKING(if libedit version is compatible)
1198                 AC_COMPILE_IFELSE(
1199                     [AC_LANG_SOURCE([[
1200 #include <histedit.h>
1201 int main(void)
1202 {
1203         int i = H_SETSIZE;
1204         el_init("", NULL, NULL, NULL);
1205         exit(0);
1206 }
1207                     ]])],
1208                     [ AC_MSG_RESULT(yes) ],
1209                     [ AC_MSG_RESULT(no)
1210                       AC_MSG_ERROR(libedit version is not compatible) ]
1211                 )
1212         fi ]
1213 )
1214
1215 AUDIT_MODULE=none
1216 AC_ARG_WITH(audit,
1217         [  --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)],
1218         [
1219           AC_MSG_CHECKING(for supported audit module)
1220           case "$withval" in
1221           bsm)
1222                 AC_MSG_RESULT(bsm)
1223                 AUDIT_MODULE=bsm
1224                 dnl    Checks for headers, libs and functions
1225                 AC_CHECK_HEADERS(bsm/audit.h, [],
1226                     [AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)],
1227                     [
1228 #ifdef HAVE_TIME_H
1229 # include <time.h>
1230 #endif
1231                     ]
1232 )
1233                 AC_CHECK_LIB(bsm, getaudit, [],
1234                     [AC_MSG_ERROR(BSM enabled and required library not found)])
1235                 AC_CHECK_FUNCS(getaudit, [],
1236                     [AC_MSG_ERROR(BSM enabled and required function not found)])
1237                 # These are optional
1238                 AC_CHECK_FUNCS(getaudit_addr aug_get_machine)
1239                 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
1240                 ;;
1241           debug)
1242                 AUDIT_MODULE=debug
1243                 AC_MSG_RESULT(debug)
1244                 AC_DEFINE(SSH_AUDIT_EVENTS, 1, Use audit debugging module)
1245                 ;;
1246           no)
1247                 AC_MSG_RESULT(no)
1248                 ;;
1249           *)
1250                 AC_MSG_ERROR([Unknown audit module $withval])
1251                 ;;
1252         esac ]
1253 )
1254
1255 dnl    Checks for library functions. Please keep in alphabetical order
1256 AC_CHECK_FUNCS( \
1257         arc4random \
1258         asprintf \
1259         b64_ntop \
1260         __b64_ntop \
1261         b64_pton \
1262         __b64_pton \
1263         bcopy \
1264         bindresvport_sa \
1265         clock \
1266         closefrom \
1267         dirfd \
1268         fchmod \
1269         fchown \
1270         freeaddrinfo \
1271         futimes \
1272         getaddrinfo \
1273         getcwd \
1274         getgrouplist \
1275         getnameinfo \
1276         getopt \
1277         getpeereid \
1278         getpeerucred \
1279         _getpty \
1280         getrlimit \
1281         getttyent \
1282         glob \
1283         inet_aton \
1284         inet_ntoa \
1285         inet_ntop \
1286         innetgr \
1287         login_getcapbool \
1288         md5_crypt \
1289         memmove \
1290         mkdtemp \
1291         mmap \
1292         ngetaddrinfo \
1293         nsleep \
1294         ogetaddrinfo \
1295         openlog_r \
1296         openpty \
1297         poll \
1298         prctl \
1299         pstat \
1300         readpassphrase \
1301         realpath \
1302         recvmsg \
1303         rresvport_af \
1304         sendmsg \
1305         setdtablesize \
1306         setegid \
1307         setenv \
1308         seteuid \
1309         setgroups \
1310         setlogin \
1311         setpcred \
1312         setproctitle \
1313         setregid \
1314         setreuid \
1315         setrlimit \
1316         setsid \
1317         setvbuf \
1318         sigaction \
1319         sigvec \
1320         snprintf \
1321         socketpair \
1322         strdup \
1323         strerror \
1324         strlcat \
1325         strlcpy \
1326         strmode \
1327         strnvis \
1328         strtonum \
1329         strtoll \
1330         strtoul \
1331         swap32 \
1332         sysconf \
1333         tcgetpgrp \
1334         truncate \
1335         unsetenv \
1336         updwtmpx \
1337         vasprintf \
1338         vhangup \
1339         vsnprintf \
1340         waitpid \
1341 )
1342
1343 # IRIX has a const char return value for gai_strerror()
1344 AC_CHECK_FUNCS(gai_strerror,[
1345         AC_DEFINE(HAVE_GAI_STRERROR)
1346         AC_TRY_COMPILE([
1347 #include <sys/types.h>
1348 #include <sys/socket.h>
1349 #include <netdb.h>
1350
1351 const char *gai_strerror(int);],[
1352 char *str;
1353
1354 str = gai_strerror(0);],[
1355                 AC_DEFINE(HAVE_CONST_GAI_STRERROR_PROTO, 1,
1356                 [Define if gai_strerror() returns const char *])])])
1357
1358 AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP, 1,
1359         [Some systems put nanosleep outside of libc]))
1360
1361 dnl Make sure prototypes are defined for these before using them.
1362 AC_CHECK_DECL(getrusage, [AC_CHECK_FUNCS(getrusage)])
1363 AC_CHECK_DECL(strsep,
1364         [AC_CHECK_FUNCS(strsep)],
1365         [],
1366         [
1367 #ifdef HAVE_STRING_H
1368 # include <string.h>
1369 #endif
1370         ])
1371
1372 dnl tcsendbreak might be a macro
1373 AC_CHECK_DECL(tcsendbreak,
1374         [AC_DEFINE(HAVE_TCSENDBREAK)],
1375         [AC_CHECK_FUNCS(tcsendbreak)],
1376         [#include <termios.h>]
1377 )
1378
1379 AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>])
1380
1381 AC_CHECK_DECLS(SHUT_RD, , ,
1382         [
1383 #include <sys/types.h>
1384 #include <sys/socket.h>
1385         ])
1386
1387 AC_CHECK_DECLS(O_NONBLOCK, , ,
1388         [
1389 #include <sys/types.h>
1390 #ifdef HAVE_SYS_STAT_H
1391 # include <sys/stat.h>
1392 #endif
1393 #ifdef HAVE_FCNTL_H
1394 # include <fcntl.h>
1395 #endif
1396         ])
1397
1398 AC_CHECK_DECLS(writev, , , [
1399 #include <sys/types.h>
1400 #include <sys/uio.h>
1401 #include <unistd.h>
1402         ])
1403
1404 AC_CHECK_DECLS(MAXSYMLINKS, , , [
1405 #include <sys/param.h>
1406         ])
1407
1408 AC_CHECK_DECLS(offsetof, , , [
1409 #include <stddef.h>
1410         ])
1411
1412 AC_CHECK_FUNCS(setresuid, [
1413         dnl Some platorms have setresuid that isn't implemented, test for this
1414         AC_MSG_CHECKING(if setresuid seems to work)
1415         AC_RUN_IFELSE(
1416                 [AC_LANG_SOURCE([[
1417 #include <stdlib.h>
1418 #include <errno.h>
1419 int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1420                 ]])],
1421                 [AC_MSG_RESULT(yes)],
1422                 [AC_DEFINE(BROKEN_SETRESUID, 1,
1423                         [Define if your setresuid() is broken])
1424                  AC_MSG_RESULT(not implemented)],
1425                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1426         )
1427 ])
1428
1429 AC_CHECK_FUNCS(setresgid, [
1430         dnl Some platorms have setresgid that isn't implemented, test for this
1431         AC_MSG_CHECKING(if setresgid seems to work)
1432         AC_RUN_IFELSE(
1433                 [AC_LANG_SOURCE([[
1434 #include <stdlib.h>
1435 #include <errno.h>
1436 int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1437                 ]])],
1438                 [AC_MSG_RESULT(yes)],
1439                 [AC_DEFINE(BROKEN_SETRESGID, 1,
1440                         [Define if your setresgid() is broken])
1441                  AC_MSG_RESULT(not implemented)],
1442                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1443         )
1444 ])
1445
1446 dnl    Checks for time functions
1447 AC_CHECK_FUNCS(gettimeofday time)
1448 dnl    Checks for utmp functions
1449 AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent)
1450 AC_CHECK_FUNCS(utmpname)
1451 dnl    Checks for utmpx functions
1452 AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
1453 AC_CHECK_FUNCS(setutxent utmpxname)
1454
1455 AC_CHECK_FUNC(daemon,
1456         [AC_DEFINE(HAVE_DAEMON, 1, [Define if your libraries define daemon()])],
1457         [AC_CHECK_LIB(bsd, daemon,
1458                 [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
1459 )
1460
1461 AC_CHECK_FUNC(getpagesize,
1462         [AC_DEFINE(HAVE_GETPAGESIZE, 1,
1463                 [Define if your libraries define getpagesize()])],
1464         [AC_CHECK_LIB(ucb, getpagesize,
1465                 [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
1466 )
1467
1468 # Check for broken snprintf
1469 if test "x$ac_cv_func_snprintf" = "xyes" ; then
1470         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
1471         AC_RUN_IFELSE(
1472                 [AC_LANG_SOURCE([[
1473 #include <stdio.h>
1474 int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
1475                 ]])],
1476                 [AC_MSG_RESULT(yes)],
1477                 [
1478                         AC_MSG_RESULT(no)
1479                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1480                                 [Define if your snprintf is busted])
1481                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
1482                 ],
1483                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
1484         )
1485 fi
1486
1487 # If we don't have a working asprintf, then we strongly depend on vsnprintf
1488 # returning the right thing on overflow: the number of characters it tried to
1489 # create (as per SUSv3)
1490 if test "x$ac_cv_func_asprintf" != "xyes" && \
1491    test "x$ac_cv_func_vsnprintf" = "xyes" ; then
1492         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
1493         AC_RUN_IFELSE(
1494                 [AC_LANG_SOURCE([[
1495 #include <sys/types.h>
1496 #include <stdio.h>
1497 #include <stdarg.h>
1498
1499 int x_snprintf(char *str,size_t count,const char *fmt,...)
1500 {
1501         size_t ret; va_list ap;
1502         va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
1503         return ret;
1504 }
1505 int main(void)
1506 {
1507         char x[1];
1508         exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
1509 } ]])],
1510                 [AC_MSG_RESULT(yes)],
1511                 [
1512                         AC_MSG_RESULT(no)
1513                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1514                                 [Define if your snprintf is busted])
1515                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
1516                 ],
1517                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
1518         )
1519 fi
1520
1521 # On systems where [v]snprintf is broken, but is declared in stdio,
1522 # check that the fmt argument is const char * or just char *.
1523 # This is only useful for when BROKEN_SNPRINTF
1524 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
1525 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#include <stdio.h>
1526            int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
1527            int main(void) { snprintf(0, 0, 0); }
1528     ]])],
1529    [AC_MSG_RESULT(yes)
1530     AC_DEFINE(SNPRINTF_CONST, [const],
1531               [Define as const if snprintf() can declare const char *fmt])],
1532    [AC_MSG_RESULT(no)
1533     AC_DEFINE(SNPRINTF_CONST, [/* not const */])])
1534
1535 # Check for missing getpeereid (or equiv) support
1536 NO_PEERCHECK=""
1537 if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
1538         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
1539         AC_TRY_COMPILE(
1540                 [#include <sys/types.h>
1541                  #include <sys/socket.h>],
1542                 [int i = SO_PEERCRED;],
1543                 [ AC_MSG_RESULT(yes)
1544                   AC_DEFINE(HAVE_SO_PEERCRED, 1, [Have PEERCRED socket option])
1545                 ],
1546                 [AC_MSG_RESULT(no)
1547                 NO_PEERCHECK=1]
1548         )
1549 fi
1550
1551 dnl see whether mkstemp() requires XXXXXX
1552 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
1553 AC_MSG_CHECKING([for (overly) strict mkstemp])
1554 AC_RUN_IFELSE(
1555         [AC_LANG_SOURCE([[
1556 #include <stdlib.h>
1557 main() { char template[]="conftest.mkstemp-test";
1558 if (mkstemp(template) == -1)
1559         exit(1);
1560 unlink(template); exit(0);
1561 }
1562         ]])],
1563         [
1564                 AC_MSG_RESULT(no)
1565         ],
1566         [
1567                 AC_MSG_RESULT(yes)
1568                 AC_DEFINE(HAVE_STRICT_MKSTEMP, 1, [Silly mkstemp()])
1569         ],
1570         [
1571                 AC_MSG_RESULT(yes)
1572                 AC_DEFINE(HAVE_STRICT_MKSTEMP)
1573         ]
1574 )
1575 fi
1576
1577 dnl make sure that openpty does not reacquire controlling terminal
1578 if test ! -z "$check_for_openpty_ctty_bug"; then
1579         AC_MSG_CHECKING(if openpty correctly handles controlling tty)
1580         AC_RUN_IFELSE(
1581                 [AC_LANG_SOURCE([[
1582 #include <stdio.h>
1583 #include <sys/fcntl.h>
1584 #include <sys/types.h>
1585 #include <sys/wait.h>
1586
1587 int
1588 main()
1589 {
1590         pid_t pid;
1591         int fd, ptyfd, ttyfd, status;
1592
1593         pid = fork();
1594         if (pid < 0) {          /* failed */
1595                 exit(1);
1596         } else if (pid > 0) {   /* parent */
1597                 waitpid(pid, &status, 0);
1598                 if (WIFEXITED(status))
1599                         exit(WEXITSTATUS(status));
1600                 else
1601                         exit(2);
1602         } else {                /* child */
1603                 close(0); close(1); close(2);
1604                 setsid();
1605                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
1606                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
1607                 if (fd >= 0)
1608                         exit(3);        /* Acquired ctty: broken */
1609                 else
1610                         exit(0);        /* Did not acquire ctty: OK */
1611         }
1612 }
1613                 ]])],
1614                 [
1615                         AC_MSG_RESULT(yes)
1616                 ],
1617                 [
1618                         AC_MSG_RESULT(no)
1619                         AC_DEFINE(SSHD_ACQUIRES_CTTY)
1620                 ],
1621                 [
1622                         AC_MSG_RESULT(cross-compiling, assuming yes)
1623                 ]
1624         )
1625 fi
1626
1627 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1628     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
1629         AC_MSG_CHECKING(if getaddrinfo seems to work)
1630         AC_RUN_IFELSE(
1631                 [AC_LANG_SOURCE([[
1632 #include <stdio.h>
1633 #include <sys/socket.h>
1634 #include <netdb.h>
1635 #include <errno.h>
1636 #include <netinet/in.h>
1637
1638 #define TEST_PORT "2222"
1639
1640 int
1641 main(void)
1642 {
1643         int err, sock;
1644         struct addrinfo *gai_ai, *ai, hints;
1645         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1646
1647         memset(&hints, 0, sizeof(hints));
1648         hints.ai_family = PF_UNSPEC;
1649         hints.ai_socktype = SOCK_STREAM;
1650         hints.ai_flags = AI_PASSIVE;
1651
1652         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1653         if (err != 0) {
1654                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1655                 exit(1);
1656         }
1657
1658         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1659                 if (ai->ai_family != AF_INET6)
1660                         continue;
1661
1662                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1663                     sizeof(ntop), strport, sizeof(strport),
1664                     NI_NUMERICHOST|NI_NUMERICSERV);
1665
1666                 if (err != 0) {
1667                         if (err == EAI_SYSTEM)
1668                                 perror("getnameinfo EAI_SYSTEM");
1669                         else
1670                                 fprintf(stderr, "getnameinfo failed: %s\n",
1671                                     gai_strerror(err));
1672                         exit(2);
1673                 }
1674
1675                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
1676                 if (sock < 0)
1677                         perror("socket");
1678                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1679                         if (errno == EBADF)
1680                                 exit(3);
1681                 }
1682         }
1683         exit(0);
1684 }
1685                 ]])],
1686                 [
1687                         AC_MSG_RESULT(yes)
1688                 ],
1689                 [
1690                         AC_MSG_RESULT(no)
1691                         AC_DEFINE(BROKEN_GETADDRINFO)
1692                 ],
1693                 [
1694                         AC_MSG_RESULT(cross-compiling, assuming yes)
1695                 ]
1696         )
1697 fi
1698
1699 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1700     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
1701         AC_MSG_CHECKING(if getaddrinfo seems to work)
1702         AC_RUN_IFELSE(
1703                 [AC_LANG_SOURCE([[
1704 #include <stdio.h>
1705 #include <sys/socket.h>
1706 #include <netdb.h>
1707 #include <errno.h>
1708 #include <netinet/in.h>
1709
1710 #define TEST_PORT "2222"
1711
1712 int
1713 main(void)
1714 {
1715         int err, sock;
1716         struct addrinfo *gai_ai, *ai, hints;
1717         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1718
1719         memset(&hints, 0, sizeof(hints));
1720         hints.ai_family = PF_UNSPEC;
1721         hints.ai_socktype = SOCK_STREAM;
1722         hints.ai_flags = AI_PASSIVE;
1723
1724         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1725         if (err != 0) {
1726                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1727                 exit(1);
1728         }
1729
1730         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1731                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1732                         continue;
1733
1734                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1735                     sizeof(ntop), strport, sizeof(strport),
1736                     NI_NUMERICHOST|NI_NUMERICSERV);
1737
1738                 if (ai->ai_family == AF_INET && err != 0) {
1739                         perror("getnameinfo");
1740                         exit(2);
1741                 }
1742         }
1743         exit(0);
1744 }
1745                 ]])],
1746                 [
1747                         AC_MSG_RESULT(yes)
1748                         AC_DEFINE(AIX_GETNAMEINFO_HACK, 1,
1749                                 [Define if you have a getaddrinfo that fails
1750                                 for the all-zeros IPv6 address])
1751                 ],
1752                 [
1753                         AC_MSG_RESULT(no)
1754                         AC_DEFINE(BROKEN_GETADDRINFO)
1755                 ],
1756                 [
1757                         AC_MSG_RESULT(cross-compiling, assuming no)
1758                 ]
1759         )
1760 fi
1761
1762 if test "x$check_for_conflicting_getspnam" = "x1"; then
1763         AC_MSG_CHECKING(for conflicting getspnam in shadow.h)
1764         AC_COMPILE_IFELSE(
1765                 [
1766 #include <shadow.h>
1767 int main(void) {exit(0);}
1768                 ],
1769                 [
1770                         AC_MSG_RESULT(no)
1771                 ],
1772                 [
1773                         AC_MSG_RESULT(yes)
1774                         AC_DEFINE(GETSPNAM_CONFLICTING_DEFS, 1,
1775                             [Conflicting defs for getspnam])
1776                 ]
1777         )
1778 fi
1779
1780 AC_FUNC_GETPGRP
1781
1782 # Search for OpenSSL
1783 saved_CPPFLAGS="$CPPFLAGS"
1784 saved_LDFLAGS="$LDFLAGS"
1785 AC_ARG_WITH(ssl-dir,
1786         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
1787         [
1788                 if test "x$withval" != "xno" ; then
1789                         case "$withval" in
1790                                 # Relative paths
1791                                 ./*|../*)       withval="`pwd`/$withval"
1792                         esac
1793                         if test -d "$withval/lib"; then
1794                                 if test -n "${need_dash_r}"; then
1795                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1796                                 else
1797                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1798                                 fi
1799                         else
1800                                 if test -n "${need_dash_r}"; then
1801                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1802                                 else
1803                                         LDFLAGS="-L${withval} ${LDFLAGS}"
1804                                 fi
1805                         fi
1806                         if test -d "$withval/include"; then
1807                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1808                         else
1809                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
1810                         fi
1811                 fi
1812         ]
1813 )
1814 LIBS="-lcrypto $LIBS"
1815 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL, 1,
1816         [Define if your ssl headers are included
1817         with #include <openssl/header.h>]),
1818         [
1819                 dnl Check default openssl install dir
1820                 if test -n "${need_dash_r}"; then
1821                         LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
1822                 else
1823                         LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
1824                 fi
1825                 CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
1826                 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
1827                         [
1828                                 AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
1829                         ]
1830                 )
1831         ]
1832 )
1833
1834 # Determine OpenSSL header version
1835 AC_MSG_CHECKING([OpenSSL header version])
1836 AC_RUN_IFELSE(
1837         [AC_LANG_SOURCE([[
1838 #include <stdio.h>
1839 #include <string.h>
1840 #include <openssl/opensslv.h>
1841 #define DATA "conftest.sslincver"
1842 int main(void) {
1843         FILE *fd;
1844         int rc;
1845
1846         fd = fopen(DATA,"w");
1847         if(fd == NULL)
1848                 exit(1);
1849
1850         if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
1851                 exit(1);
1852
1853         exit(0);
1854 }
1855         ]])],
1856         [
1857                 ssl_header_ver=`cat conftest.sslincver`
1858                 AC_MSG_RESULT($ssl_header_ver)
1859         ],
1860         [
1861                 AC_MSG_RESULT(not found)
1862                 AC_MSG_ERROR(OpenSSL version header not found.)
1863         ],
1864         [
1865                 AC_MSG_WARN([cross compiling: not checking])
1866         ]
1867 )
1868
1869 # Determine OpenSSL library version
1870 AC_MSG_CHECKING([OpenSSL library version])
1871 AC_RUN_IFELSE(
1872         [AC_LANG_SOURCE([[
1873 #include <stdio.h>
1874 #include <string.h>
1875 #include <openssl/opensslv.h>
1876 #include <openssl/crypto.h>
1877 #define DATA "conftest.ssllibver"
1878 int main(void) {
1879         FILE *fd;
1880         int rc;
1881
1882         fd = fopen(DATA,"w");
1883         if(fd == NULL)
1884                 exit(1);
1885
1886         if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
1887                 exit(1);
1888
1889         exit(0);
1890 }
1891         ]])],
1892         [
1893                 ssl_library_ver=`cat conftest.ssllibver`
1894                 AC_MSG_RESULT($ssl_library_ver)
1895         ],
1896         [
1897                 AC_MSG_RESULT(not found)
1898                 AC_MSG_ERROR(OpenSSL library not found.)
1899         ],
1900         [
1901                 AC_MSG_WARN([cross compiling: not checking])
1902         ]
1903 )
1904
1905 AC_ARG_WITH(openssl-header-check,
1906         [  --without-openssl-header-check Disable OpenSSL version consistency check],
1907         [  if test "x$withval" = "xno" ; then
1908                 openssl_check_nonfatal=1
1909            fi
1910         ]
1911 )
1912
1913 # Sanity check OpenSSL headers
1914 AC_MSG_CHECKING([whether OpenSSL's headers match the library])
1915 AC_RUN_IFELSE(
1916         [AC_LANG_SOURCE([[
1917 #include <string.h>
1918 #include <openssl/opensslv.h>
1919 int main(void) { exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
1920         ]])],
1921         [
1922                 AC_MSG_RESULT(yes)
1923         ],
1924         [
1925                 AC_MSG_RESULT(no)
1926                 if test "x$openssl_check_nonfatal" = "x"; then
1927                         AC_MSG_ERROR([Your OpenSSL headers do not match your
1928 library. Check config.log for details.
1929 If you are sure your installation is consistent, you can disable the check
1930 by running "./configure --without-openssl-header-check".
1931 Also see contrib/findssl.sh for help identifying header/library mismatches.
1932 ])
1933                 else
1934                         AC_MSG_WARN([Your OpenSSL headers do not match your
1935 library. Check config.log for details.
1936 Also see contrib/findssl.sh for help identifying header/library mismatches.])
1937                 fi
1938         ],
1939         [
1940                 AC_MSG_WARN([cross compiling: not checking])
1941         ]
1942 )
1943
1944 AC_MSG_CHECKING([if programs using OpenSSL functions will link])
1945 AC_LINK_IFELSE(
1946         [AC_LANG_SOURCE([[
1947 #include <openssl/evp.h>
1948 int main(void) { SSLeay_add_all_algorithms(); }
1949         ]])],
1950         [
1951                 AC_MSG_RESULT(yes)
1952         ],
1953         [
1954                 AC_MSG_RESULT(no)
1955                 saved_LIBS="$LIBS"
1956                 LIBS="$LIBS -ldl"
1957                 AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
1958                 AC_LINK_IFELSE(
1959                         [AC_LANG_SOURCE([[
1960 #include <openssl/evp.h>
1961 int main(void) { SSLeay_add_all_algorithms(); }
1962                         ]])],
1963                         [
1964                                 AC_MSG_RESULT(yes)
1965                         ],
1966                         [
1967                                 AC_MSG_RESULT(no)
1968                                 LIBS="$saved_LIBS"
1969                         ]
1970                 )
1971         ]
1972 )
1973
1974 AC_ARG_WITH(ssl-engine,
1975         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
1976         [ if test "x$withval" != "xno" ; then
1977                 AC_MSG_CHECKING(for OpenSSL ENGINE support)
1978                 AC_TRY_COMPILE(
1979                         [ #include <openssl/engine.h>],
1980                         [
1981 ENGINE_load_builtin_engines();ENGINE_register_all_complete();
1982                         ],
1983                         [ AC_MSG_RESULT(yes)
1984                           AC_DEFINE(USE_OPENSSL_ENGINE, 1,
1985                              [Enable OpenSSL engine support])
1986                         ],
1987                         [ AC_MSG_ERROR(OpenSSL ENGINE support not found)]
1988                 )
1989           fi ]
1990 )
1991
1992 # Check for OpenSSL without EVP_aes_{192,256}_cbc
1993 AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
1994 AC_LINK_IFELSE(
1995         [AC_LANG_SOURCE([[
1996 #include <string.h>
1997 #include <openssl/evp.h>
1998 int main(void) { exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);}
1999         ]])],
2000         [
2001                 AC_MSG_RESULT(no)
2002         ],
2003         [
2004                 AC_MSG_RESULT(yes)
2005                 AC_DEFINE(OPENSSL_LOBOTOMISED_AES, 1,
2006                     [libcrypto is missing AES 192 and 256 bit functions])
2007         ]
2008 )
2009
2010 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
2011 # because the system crypt() is more featureful.
2012 if test "x$check_for_libcrypt_before" = "x1"; then
2013         AC_CHECK_LIB(crypt, crypt)
2014 fi
2015
2016 # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
2017 # version in OpenSSL.
2018 if test "x$check_for_libcrypt_later" = "x1"; then
2019         AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
2020 fi
2021
2022 # Search for SHA256 support in libc and/or OpenSSL
2023 AC_CHECK_FUNCS(SHA256_Update EVP_sha256)
2024
2025 saved_LIBS="$LIBS"
2026 AC_CHECK_LIB(iaf, ia_openinfo, [
2027         LIBS="$LIBS -liaf"
2028         AC_CHECK_FUNCS(set_id, [SSHDLIBS="$SSHDLIBS -liaf"
2029                                 AC_DEFINE(HAVE_LIBIAF, 1,
2030                         [Define if system has libiaf that supports set_id])
2031                                 ])
2032 ])
2033 LIBS="$saved_LIBS"
2034
2035 ### Configure cryptographic random number support
2036
2037 # Check wheter OpenSSL seeds itself
2038 AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
2039 AC_RUN_IFELSE(
2040         [AC_LANG_SOURCE([[
2041 #include <string.h>
2042 #include <openssl/rand.h>
2043 int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
2044         ]])],
2045         [
2046                 OPENSSL_SEEDS_ITSELF=yes
2047                 AC_MSG_RESULT(yes)
2048         ],
2049         [
2050                 AC_MSG_RESULT(no)
2051                 # Default to use of the rand helper if OpenSSL doesn't
2052                 # seed itself
2053                 USE_RAND_HELPER=yes
2054         ],
2055         [
2056                 AC_MSG_WARN([cross compiling: assuming yes])
2057                 # This is safe, since all recent OpenSSL versions will
2058                 # complain at runtime if not seeded correctly.
2059                 OPENSSL_SEEDS_ITSELF=yes
2060         ]
2061 )
2062
2063 # Check for PAM libs
2064 PAM_MSG="no"
2065 AC_ARG_WITH(pam,
2066         [  --with-pam              Enable PAM support ],
2067         [
2068                 if test "x$withval" != "xno" ; then
2069                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
2070                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
2071                                 AC_MSG_ERROR([PAM headers not found])
2072                         fi
2073
2074                         saved_LIBS="$LIBS"
2075                         AC_CHECK_LIB(dl, dlopen, , )
2076                         AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
2077                         AC_CHECK_FUNCS(pam_getenvlist)
2078                         AC_CHECK_FUNCS(pam_putenv)
2079                         LIBS="$saved_LIBS"
2080
2081                         PAM_MSG="yes"
2082
2083                         SSHDLIBS="$SSHDLIBS -lpam"
2084                         AC_DEFINE(USE_PAM, 1,
2085                                 [Define if you want to enable PAM support])
2086
2087                         if test $ac_cv_lib_dl_dlopen = yes; then
2088                                 case "$LIBS" in
2089                                 *-ldl*)
2090                                         # libdl already in LIBS
2091                                         ;;
2092                                 *)
2093                                         SSHDLIBS="$SSHDLIBS -ldl"
2094                                         ;;
2095                                 esac
2096                         fi
2097                 fi
2098         ]
2099 )
2100
2101 # Check for older PAM
2102 if test "x$PAM_MSG" = "xyes" ; then
2103         # Check PAM strerror arguments (old PAM)
2104         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
2105         AC_TRY_COMPILE(
2106                 [
2107 #include <stdlib.h>
2108 #if defined(HAVE_SECURITY_PAM_APPL_H)
2109 #include <security/pam_appl.h>
2110 #elif defined (HAVE_PAM_PAM_APPL_H)
2111 #include <pam/pam_appl.h>
2112 #endif
2113                 ],
2114                 [(void)pam_strerror((pam_handle_t *)NULL, -1);],
2115                 [AC_MSG_RESULT(no)],
2116                 [
2117                         AC_DEFINE(HAVE_OLD_PAM, 1,
2118                                 [Define if you have an old version of PAM
2119                                 which takes only one argument to pam_strerror])
2120                         AC_MSG_RESULT(yes)
2121                         PAM_MSG="yes (old library)"
2122                 ]
2123         )
2124 fi
2125
2126 # Do we want to force the use of the rand helper?
2127 AC_ARG_WITH(rand-helper,
2128         [  --with-rand-helper      Use subprocess to gather strong randomness ],
2129         [
2130                 if test "x$withval" = "xno" ; then
2131                         # Force use of OpenSSL's internal RNG, even if
2132                         # the previous test showed it to be unseeded.
2133                         if test -z "$OPENSSL_SEEDS_ITSELF" ; then
2134                                 AC_MSG_WARN([*** Forcing use of OpenSSL's non-self-seeding PRNG])
2135                                 OPENSSL_SEEDS_ITSELF=yes
2136                                 USE_RAND_HELPER=""
2137                         fi
2138                 else
2139                         USE_RAND_HELPER=yes
2140                 fi
2141         ],
2142 )
2143
2144 # Which randomness source do we use?
2145 if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
2146         # OpenSSL only
2147         AC_DEFINE(OPENSSL_PRNG_ONLY, 1,
2148                 [Define if you want OpenSSL's internally seeded PRNG only])
2149         RAND_MSG="OpenSSL internal ONLY"
2150         INSTALL_SSH_RAND_HELPER=""
2151 elif test ! -z "$USE_RAND_HELPER" ; then
2152         # install rand helper
2153         RAND_MSG="ssh-rand-helper"
2154         INSTALL_SSH_RAND_HELPER="yes"
2155 fi
2156 AC_SUBST(INSTALL_SSH_RAND_HELPER)
2157
2158 ### Configuration of ssh-rand-helper
2159
2160 # PRNGD TCP socket
2161 AC_ARG_WITH(prngd-port,
2162         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
2163         [
2164                 case "$withval" in
2165                 no)
2166                         withval=""
2167                         ;;
2168                 [[0-9]]*)
2169                         ;;
2170                 *)
2171                         AC_MSG_ERROR(You must specify a numeric port number for --with-prngd-port)
2172                         ;;
2173                 esac
2174                 if test ! -z "$withval" ; then
2175                         PRNGD_PORT="$withval"
2176                         AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT,
2177                                 [Port number of PRNGD/EGD random number socket])
2178                 fi
2179         ]
2180 )
2181
2182 # PRNGD Unix domain socket
2183 AC_ARG_WITH(prngd-socket,
2184         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
2185         [
2186                 case "$withval" in
2187                 yes)
2188                         withval="/var/run/egd-pool"
2189                         ;;
2190                 no)
2191                         withval=""
2192                         ;;
2193                 /*)
2194                         ;;
2195                 *)
2196                         AC_MSG_ERROR(You must specify an absolute path to the entropy socket)
2197                         ;;
2198                 esac
2199
2200                 if test ! -z "$withval" ; then
2201                         if test ! -z "$PRNGD_PORT" ; then
2202                                 AC_MSG_ERROR(You may not specify both a PRNGD/EGD port and socket)
2203                         fi
2204                         if test ! -r "$withval" ; then
2205                                 AC_MSG_WARN(Entropy socket is not readable)
2206                         fi
2207                         PRNGD_SOCKET="$withval"
2208                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET",
2209                                 [Location of PRNGD/EGD random number socket])
2210                 fi
2211         ],
2212         [
2213                 # Check for existing socket only if we don't have a random device already
2214                 if test "$USE_RAND_HELPER" = yes ; then
2215                         AC_MSG_CHECKING(for PRNGD/EGD socket)
2216                         # Insert other locations here
2217                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
2218                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
2219                                         PRNGD_SOCKET="$sock"
2220                                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
2221                                         break;
2222                                 fi
2223                         done
2224                         if test ! -z "$PRNGD_SOCKET" ; then
2225                                 AC_MSG_RESULT($PRNGD_SOCKET)
2226                         else
2227                                 AC_MSG_RESULT(not found)
2228                         fi
2229                 fi
2230         ]
2231 )
2232
2233 # Change default command timeout for hashing entropy source
2234 entropy_timeout=200
2235 AC_ARG_WITH(entropy-timeout,
2236         [  --with-entropy-timeout  Specify entropy gathering command timeout (msec)],
2237         [
2238                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2239                     test "x${withval}" != "xyes"; then
2240                         entropy_timeout=$withval
2241                 fi
2242         ]
2243 )
2244 AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout,
2245         [Builtin PRNG command timeout])
2246
2247 SSH_PRIVSEP_USER=sshd
2248 AC_ARG_WITH(privsep-user,
2249         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
2250         [
2251                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2252                     test "x${withval}" != "xyes"; then
2253                         SSH_PRIVSEP_USER=$withval
2254                 fi
2255         ]
2256 )
2257 AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER",
2258         [non-privileged user for privilege separation])
2259 AC_SUBST(SSH_PRIVSEP_USER)
2260
2261 # We do this little dance with the search path to insure
2262 # that programs that we select for use by installed programs
2263 # (which may be run by the super-user) come from trusted
2264 # locations before they come from the user's private area.
2265 # This should help avoid accidentally configuring some
2266 # random version of a program in someone's personal bin.
2267
2268 OPATH=$PATH
2269 PATH=/bin:/usr/bin
2270 test -h /bin 2> /dev/null && PATH=/usr/bin
2271 test -d /sbin && PATH=$PATH:/sbin
2272 test -d /usr/sbin && PATH=$PATH:/usr/sbin
2273 PATH=$PATH:/etc:$OPATH
2274
2275 # These programs are used by the command hashing source to gather entropy
2276 OSSH_PATH_ENTROPY_PROG(PROG_LS, ls)
2277 OSSH_PATH_ENTROPY_PROG(PROG_NETSTAT, netstat)
2278 OSSH_PATH_ENTROPY_PROG(PROG_ARP, arp)
2279 OSSH_PATH_ENTROPY_PROG(PROG_IFCONFIG, ifconfig)
2280 OSSH_PATH_ENTROPY_PROG(PROG_JSTAT, jstat)
2281 OSSH_PATH_ENTROPY_PROG(PROG_PS, ps)
2282 OSSH_PATH_ENTROPY_PROG(PROG_SAR, sar)
2283 OSSH_PATH_ENTROPY_PROG(PROG_W, w)
2284 OSSH_PATH_ENTROPY_PROG(PROG_WHO, who)
2285 OSSH_PATH_ENTROPY_PROG(PROG_LAST, last)
2286 OSSH_PATH_ENTROPY_PROG(PROG_LASTLOG, lastlog)
2287 OSSH_PATH_ENTROPY_PROG(PROG_DF, df)
2288 OSSH_PATH_ENTROPY_PROG(PROG_VMSTAT, vmstat)
2289 OSSH_PATH_ENTROPY_PROG(PROG_UPTIME, uptime)
2290 OSSH_PATH_ENTROPY_PROG(PROG_IPCS, ipcs)
2291 OSSH_PATH_ENTROPY_PROG(PROG_TAIL, tail)
2292 # restore PATH
2293 PATH=$OPATH
2294
2295 # Where does ssh-rand-helper get its randomness from?
2296 INSTALL_SSH_PRNG_CMDS=""
2297 if test ! -z "$INSTALL_SSH_RAND_HELPER" ; then
2298         if test ! -z "$PRNGD_PORT" ; then
2299                 RAND_HELPER_MSG="TCP localhost:$PRNGD_PORT"
2300         elif test ! -z "$PRNGD_SOCKET" ; then
2301                 RAND_HELPER_MSG="Unix domain socket \"$PRNGD_SOCKET\""
2302         else
2303                 RAND_HELPER_MSG="Command hashing (timeout $entropy_timeout)"
2304                 RAND_HELPER_CMDHASH=yes
2305                 INSTALL_SSH_PRNG_CMDS="yes"
2306         fi
2307 fi
2308 AC_SUBST(INSTALL_SSH_PRNG_CMDS)
2309
2310
2311 # Cheap hack to ensure NEWS-OS libraries are arranged right.
2312 if test ! -z "$SONY" ; then
2313   LIBS="$LIBS -liberty";
2314 fi
2315
2316 # Check for  long long datatypes
2317 AC_CHECK_TYPES([long long, unsigned long long, long double])
2318
2319 # Check datatype sizes
2320 AC_CHECK_SIZEOF(char, 1)
2321 AC_CHECK_SIZEOF(short int, 2)
2322 AC_CHECK_SIZEOF(int, 4)
2323 AC_CHECK_SIZEOF(long int, 4)
2324 AC_CHECK_SIZEOF(long long int, 8)
2325
2326 # Sanity check long long for some platforms (AIX)
2327 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
2328         ac_cv_sizeof_long_long_int=0
2329 fi
2330
2331 # compute LLONG_MIN and LLONG_MAX if we don't know them.
2332 if test -z "$have_llong_max"; then
2333         AC_MSG_CHECKING([for max value of long long])
2334         AC_RUN_IFELSE(
2335                 [AC_LANG_SOURCE([[
2336 #include <stdio.h>
2337 /* Why is this so damn hard? */
2338 #ifdef __GNUC__
2339 # undef __GNUC__
2340 #endif
2341 #define __USE_ISOC99
2342 #include <limits.h>
2343 #define DATA "conftest.llminmax"
2344 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
2345
2346 /*
2347  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
2348  * we do this the hard way.
2349  */
2350 static int
2351 fprint_ll(FILE *f, long long n)
2352 {
2353         unsigned int i;
2354         int l[sizeof(long long) * 8];
2355
2356         if (n < 0)
2357                 if (fprintf(f, "-") < 0)
2358                         return -1;
2359         for (i = 0; n != 0; i++) {
2360                 l[i] = my_abs(n % 10);
2361                 n /= 10;
2362         }
2363         do {
2364                 if (fprintf(f, "%d", l[--i]) < 0)
2365                         return -1;
2366         } while (i != 0);
2367         if (fprintf(f, " ") < 0)
2368                 return -1;
2369         return 0;
2370 }
2371
2372 int main(void) {
2373         FILE *f;
2374         long long i, llmin, llmax = 0;
2375
2376         if((f = fopen(DATA,"w")) == NULL)
2377                 exit(1);
2378
2379 #if defined(LLONG_MIN) && defined(LLONG_MAX)
2380         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
2381         llmin = LLONG_MIN;
2382         llmax = LLONG_MAX;
2383 #else
2384         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
2385         /* This will work on one's complement and two's complement */
2386         for (i = 1; i > llmax; i <<= 1, i++)
2387                 llmax = i;
2388         llmin = llmax + 1LL;    /* wrap */
2389 #endif
2390
2391         /* Sanity check */
2392         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
2393             || llmax - 1 > llmax || llmin == llmax || llmin == 0
2394             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
2395                 fprintf(f, "unknown unknown\n");
2396                 exit(2);
2397         }
2398
2399         if (fprint_ll(f, llmin) < 0)
2400                 exit(3);
2401         if (fprint_ll(f, llmax) < 0)
2402                 exit(4);
2403         if (fclose(f) < 0)
2404                 exit(5);
2405         exit(0);
2406 }
2407                 ]])],
2408                 [
2409                         llong_min=`$AWK '{print $1}' conftest.llminmax`
2410                         llong_max=`$AWK '{print $2}' conftest.llminmax`
2411
2412                         AC_MSG_RESULT($llong_max)
2413                         AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
2414                             [max value of long long calculated by configure])
2415                         AC_MSG_CHECKING([for min value of long long])
2416                         AC_MSG_RESULT($llong_min)
2417                         AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
2418                             [min value of long long calculated by configure])
2419                 ],
2420                 [
2421                         AC_MSG_RESULT(not found)
2422                 ],
2423                 [
2424                         AC_MSG_WARN([cross compiling: not checking])
2425                 ]
2426         )
2427 fi
2428
2429
2430 # More checks for data types
2431 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
2432         AC_TRY_COMPILE(
2433                 [ #include <sys/types.h> ],
2434                 [ u_int a; a = 1;],
2435                 [ ac_cv_have_u_int="yes" ],
2436                 [ ac_cv_have_u_int="no" ]
2437         )
2438 ])
2439 if test "x$ac_cv_have_u_int" = "xyes" ; then
2440         AC_DEFINE(HAVE_U_INT, 1, [define if you have u_int data type])
2441         have_u_int=1
2442 fi
2443
2444 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
2445         AC_TRY_COMPILE(
2446                 [ #include <sys/types.h> ],
2447                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2448                 [ ac_cv_have_intxx_t="yes" ],
2449                 [ ac_cv_have_intxx_t="no" ]
2450         )
2451 ])
2452 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
2453         AC_DEFINE(HAVE_INTXX_T, 1, [define if you have intxx_t data type])
2454         have_intxx_t=1
2455 fi
2456
2457 if (test -z "$have_intxx_t" && \
2458            test "x$ac_cv_header_stdint_h" = "xyes")
2459 then
2460     AC_MSG_CHECKING([for intXX_t types in stdint.h])
2461         AC_TRY_COMPILE(
2462                 [ #include <stdint.h> ],
2463                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2464                 [
2465                         AC_DEFINE(HAVE_INTXX_T)
2466                         AC_MSG_RESULT(yes)
2467                 ],
2468                 [ AC_MSG_RESULT(no) ]
2469         )
2470 fi
2471
2472 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
2473         AC_TRY_COMPILE(
2474                 [
2475 #include <sys/types.h>
2476 #ifdef HAVE_STDINT_H
2477 # include <stdint.h>
2478 #endif
2479 #include <sys/socket.h>
2480 #ifdef HAVE_SYS_BITYPES_H
2481 # include <sys/bitypes.h>
2482 #endif
2483                 ],
2484                 [ int64_t a; a = 1;],
2485                 [ ac_cv_have_int64_t="yes" ],
2486                 [ ac_cv_have_int64_t="no" ]
2487         )
2488 ])
2489 if test "x$ac_cv_have_int64_t" = "xyes" ; then
2490         AC_DEFINE(HAVE_INT64_T, 1, [define if you have int64_t data type])
2491 fi
2492
2493 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
2494         AC_TRY_COMPILE(
2495                 [ #include <sys/types.h> ],
2496                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2497                 [ ac_cv_have_u_intxx_t="yes" ],
2498                 [ ac_cv_have_u_intxx_t="no" ]
2499         )
2500 ])
2501 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
2502         AC_DEFINE(HAVE_U_INTXX_T, 1, [define if you have u_intxx_t data type])
2503         have_u_intxx_t=1
2504 fi
2505
2506 if test -z "$have_u_intxx_t" ; then
2507     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
2508         AC_TRY_COMPILE(
2509                 [ #include <sys/socket.h> ],
2510                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2511                 [
2512                         AC_DEFINE(HAVE_U_INTXX_T)
2513                         AC_MSG_RESULT(yes)
2514                 ],
2515                 [ AC_MSG_RESULT(no) ]
2516         )
2517 fi
2518
2519 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
2520         AC_TRY_COMPILE(
2521                 [ #include <sys/types.h> ],
2522                 [ u_int64_t a; a = 1;],
2523                 [ ac_cv_have_u_int64_t="yes" ],
2524                 [ ac_cv_have_u_int64_t="no" ]
2525         )
2526 ])
2527 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
2528         AC_DEFINE(HAVE_U_INT64_T, 1, [define if you have u_int64_t data type])
2529         have_u_int64_t=1
2530 fi
2531
2532 if test -z "$have_u_int64_t" ; then
2533     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
2534         AC_TRY_COMPILE(
2535                 [ #include <sys/bitypes.h> ],
2536                 [ u_int64_t a; a = 1],
2537                 [
2538                         AC_DEFINE(HAVE_U_INT64_T)
2539                         AC_MSG_RESULT(yes)
2540                 ],
2541                 [ AC_MSG_RESULT(no) ]
2542         )
2543 fi
2544
2545 if test -z "$have_u_intxx_t" ; then
2546         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
2547                 AC_TRY_COMPILE(
2548                         [
2549 #include <sys/types.h>
2550                         ],
2551                         [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1; ],
2552                         [ ac_cv_have_uintxx_t="yes" ],
2553                         [ ac_cv_have_uintxx_t="no" ]
2554                 )
2555         ])
2556         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
2557                 AC_DEFINE(HAVE_UINTXX_T, 1,
2558                         [define if you have uintxx_t data type])
2559         fi
2560 fi
2561
2562 if test -z "$have_uintxx_t" ; then
2563     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
2564         AC_TRY_COMPILE(
2565                 [ #include <stdint.h> ],
2566                 [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;],
2567                 [
2568                         AC_DEFINE(HAVE_UINTXX_T)
2569                         AC_MSG_RESULT(yes)
2570                 ],
2571                 [ AC_MSG_RESULT(no) ]
2572         )
2573 fi
2574
2575 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
2576            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
2577 then
2578         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
2579         AC_TRY_COMPILE(
2580                 [
2581 #include <sys/bitypes.h>
2582                 ],
2583                 [
2584                         int8_t a; int16_t b; int32_t c;
2585                         u_int8_t e; u_int16_t f; u_int32_t g;
2586                         a = b = c = e = f = g = 1;
2587                 ],
2588                 [
2589                         AC_DEFINE(HAVE_U_INTXX_T)
2590                         AC_DEFINE(HAVE_INTXX_T)
2591                         AC_MSG_RESULT(yes)
2592                 ],
2593                 [AC_MSG_RESULT(no)]
2594         )
2595 fi
2596
2597
2598 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
2599         AC_TRY_COMPILE(
2600                 [
2601 #include <sys/types.h>
2602                 ],
2603                 [ u_char foo; foo = 125; ],
2604                 [ ac_cv_have_u_char="yes" ],
2605                 [ ac_cv_have_u_char="no" ]
2606         )
2607 ])
2608 if test "x$ac_cv_have_u_char" = "xyes" ; then
2609         AC_DEFINE(HAVE_U_CHAR, 1, [define if you have u_char data type])
2610 fi
2611
2612 TYPE_SOCKLEN_T
2613
2614 AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
2615
2616 AC_CHECK_TYPES(in_addr_t,,,
2617 [#include <sys/types.h>
2618 #include <netinet/in.h>])
2619
2620 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
2621         AC_TRY_COMPILE(
2622                 [
2623 #include <sys/types.h>
2624                 ],
2625                 [ size_t foo; foo = 1235; ],
2626                 [ ac_cv_have_size_t="yes" ],
2627                 [ ac_cv_have_size_t="no" ]
2628         )
2629 ])
2630 if test "x$ac_cv_have_size_t" = "xyes" ; then
2631         AC_DEFINE(HAVE_SIZE_T, 1, [define if you have size_t data type])
2632 fi
2633
2634 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
2635         AC_TRY_COMPILE(
2636                 [
2637 #include <sys/types.h>
2638                 ],
2639                 [ ssize_t foo; foo = 1235; ],
2640                 [ ac_cv_have_ssize_t="yes" ],
2641                 [ ac_cv_have_ssize_t="no" ]
2642         )
2643 ])
2644 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
2645         AC_DEFINE(HAVE_SSIZE_T, 1, [define if you have ssize_t data type])
2646 fi
2647
2648 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
2649         AC_TRY_COMPILE(
2650                 [
2651 #include <time.h>
2652                 ],
2653                 [ clock_t foo; foo = 1235; ],
2654                 [ ac_cv_have_clock_t="yes" ],
2655                 [ ac_cv_have_clock_t="no" ]
2656         )
2657 ])
2658 if test "x$ac_cv_have_clock_t" = "xyes" ; then
2659         AC_DEFINE(HAVE_CLOCK_T, 1, [define if you have clock_t data type])
2660 fi
2661
2662 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
2663         AC_TRY_COMPILE(
2664                 [
2665 #include <sys/types.h>
2666 #include <sys/socket.h>
2667                 ],
2668                 [ sa_family_t foo; foo = 1235; ],
2669                 [ ac_cv_have_sa_family_t="yes" ],
2670                 [ AC_TRY_COMPILE(
2671                   [
2672 #include <sys/types.h>
2673 #include <sys/socket.h>
2674 #include <netinet/in.h>
2675                 ],
2676                 [ sa_family_t foo; foo = 1235; ],
2677                 [ ac_cv_have_sa_family_t="yes" ],
2678
2679                 [ ac_cv_have_sa_family_t="no" ]
2680         )]
2681         )
2682 ])
2683 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
2684         AC_DEFINE(HAVE_SA_FAMILY_T, 1,
2685                 [define if you have sa_family_t data type])
2686 fi
2687
2688 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
2689         AC_TRY_COMPILE(
2690                 [
2691 #include <sys/types.h>
2692                 ],
2693                 [ pid_t foo; foo = 1235; ],
2694                 [ ac_cv_have_pid_t="yes" ],
2695                 [ ac_cv_have_pid_t="no" ]
2696         )
2697 ])
2698 if test "x$ac_cv_have_pid_t" = "xyes" ; then
2699         AC_DEFINE(HAVE_PID_T, 1, [define if you have pid_t data type])
2700 fi
2701
2702 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
2703         AC_TRY_COMPILE(
2704                 [
2705 #include <sys/types.h>
2706                 ],
2707                 [ mode_t foo; foo = 1235; ],
2708                 [ ac_cv_have_mode_t="yes" ],
2709                 [ ac_cv_have_mode_t="no" ]
2710         )
2711 ])
2712 if test "x$ac_cv_have_mode_t" = "xyes" ; then
2713         AC_DEFINE(HAVE_MODE_T, 1, [define if you have mode_t data type])
2714 fi
2715
2716
2717 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
2718         AC_TRY_COMPILE(
2719                 [
2720 #include <sys/types.h>
2721 #include <sys/socket.h>
2722                 ],
2723                 [ struct sockaddr_storage s; ],
2724                 [ ac_cv_have_struct_sockaddr_storage="yes" ],
2725                 [ ac_cv_have_struct_sockaddr_storage="no" ]
2726         )
2727 ])
2728 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
2729         AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
2730                 [define if you have struct sockaddr_storage data type])
2731 fi
2732
2733 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
2734         AC_TRY_COMPILE(
2735                 [
2736 #include <sys/types.h>
2737 #include <netinet/in.h>
2738                 ],
2739                 [ struct sockaddr_in6 s; s.sin6_family = 0; ],
2740                 [ ac_cv_have_struct_sockaddr_in6="yes" ],
2741                 [ ac_cv_have_struct_sockaddr_in6="no" ]
2742         )
2743 ])
2744 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
2745         AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6, 1,
2746                 [define if you have struct sockaddr_in6 data type])
2747 fi
2748
2749 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
2750         AC_TRY_COMPILE(
2751                 [
2752 #include <sys/types.h>
2753 #include <netinet/in.h>
2754                 ],
2755                 [ struct in6_addr s; s.s6_addr[0] = 0; ],
2756                 [ ac_cv_have_struct_in6_addr="yes" ],
2757                 [ ac_cv_have_struct_in6_addr="no" ]
2758         )
2759 ])
2760 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
2761         AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1,
2762                 [define if you have struct in6_addr data type])
2763 fi
2764
2765 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
2766         AC_TRY_COMPILE(
2767                 [
2768 #include <sys/types.h>
2769 #include <sys/socket.h>
2770 #include <netdb.h>
2771                 ],
2772                 [ struct addrinfo s; s.ai_flags = AI_PASSIVE; ],
2773                 [ ac_cv_have_struct_addrinfo="yes" ],
2774                 [ ac_cv_have_struct_addrinfo="no" ]
2775         )
2776 ])
2777 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
2778         AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1,
2779                 [define if you have struct addrinfo data type])
2780 fi
2781
2782 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
2783         AC_TRY_COMPILE(
2784                 [ #include <sys/time.h> ],
2785                 [ struct timeval tv; tv.tv_sec = 1;],
2786                 [ ac_cv_have_struct_timeval="yes" ],
2787                 [ ac_cv_have_struct_timeval="no" ]
2788         )
2789 ])
2790 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
2791         AC_DEFINE(HAVE_STRUCT_TIMEVAL, 1, [define if you have struct timeval])
2792         have_struct_timeval=1
2793 fi
2794
2795 AC_CHECK_TYPES(struct timespec)
2796
2797 # We need int64_t or else certian parts of the compile will fail.
2798 if test "x$ac_cv_have_int64_t" = "xno" && \
2799         test "x$ac_cv_sizeof_long_int" != "x8" && \
2800         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
2801         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
2802         echo "an alternative compiler (I.E., GCC) before continuing."
2803         echo ""
2804         exit 1;
2805 else
2806 dnl test snprintf (broken on SCO w/gcc)
2807         AC_RUN_IFELSE(
2808                 [AC_LANG_SOURCE([[
2809 #include <stdio.h>
2810 #include <string.h>
2811 #ifdef HAVE_SNPRINTF
2812 main()
2813 {
2814         char buf[50];
2815         char expected_out[50];
2816         int mazsize = 50 ;
2817 #if (SIZEOF_LONG_INT == 8)
2818         long int num = 0x7fffffffffffffff;
2819 #else
2820         long long num = 0x7fffffffffffffffll;
2821 #endif
2822         strcpy(expected_out, "9223372036854775807");
2823         snprintf(buf, mazsize, "%lld", num);
2824         if(strcmp(buf, expected_out) != 0)
2825                 exit(1);
2826         exit(0);
2827 }
2828 #else
2829 main() { exit(0); }
2830 #endif
2831                 ]])], [ true ], [ AC_DEFINE(BROKEN_SNPRINTF) ],
2832                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
2833         )
2834 fi
2835
2836 dnl Checks for structure members
2837 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmp.h, HAVE_HOST_IN_UTMP)
2838 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmpx.h, HAVE_HOST_IN_UTMPX)
2839 OSSH_CHECK_HEADER_FOR_FIELD(syslen, utmpx.h, HAVE_SYSLEN_IN_UTMPX)
2840 OSSH_CHECK_HEADER_FOR_FIELD(ut_pid, utmp.h, HAVE_PID_IN_UTMP)
2841 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmp.h, HAVE_TYPE_IN_UTMP)
2842 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmpx.h, HAVE_TYPE_IN_UTMPX)
2843 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmp.h, HAVE_TV_IN_UTMP)
2844 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmp.h, HAVE_ID_IN_UTMP)
2845 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmpx.h, HAVE_ID_IN_UTMPX)
2846 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmp.h, HAVE_ADDR_IN_UTMP)
2847 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmpx.h, HAVE_ADDR_IN_UTMPX)
2848 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmp.h, HAVE_ADDR_V6_IN_UTMP)
2849 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmpx.h, HAVE_ADDR_V6_IN_UTMPX)
2850 OSSH_CHECK_HEADER_FOR_FIELD(ut_exit, utmp.h, HAVE_EXIT_IN_UTMP)
2851 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmp.h, HAVE_TIME_IN_UTMP)
2852 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmpx.h, HAVE_TIME_IN_UTMPX)
2853 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmpx.h, HAVE_TV_IN_UTMPX)
2854
2855 AC_CHECK_MEMBERS([struct stat.st_blksize])
2856 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE(__res_state, state,
2857         [Define if we don't have struct __res_state in resolv.h])],
2858 [
2859 #include <stdio.h>
2860 #if HAVE_SYS_TYPES_H
2861 # include <sys/types.h>
2862 #endif
2863 #include <netinet/in.h>
2864 #include <arpa/nameser.h>
2865 #include <resolv.h>
2866 ])
2867
2868 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
2869                 ac_cv_have_ss_family_in_struct_ss, [
2870         AC_TRY_COMPILE(
2871                 [
2872 #include <sys/types.h>
2873 #include <sys/socket.h>
2874                 ],
2875                 [ struct sockaddr_storage s; s.ss_family = 1; ],
2876                 [ ac_cv_have_ss_family_in_struct_ss="yes" ],
2877                 [ ac_cv_have_ss_family_in_struct_ss="no" ],
2878         )
2879 ])
2880 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
2881         AC_DEFINE(HAVE_SS_FAMILY_IN_SS, 1, [Fields in struct sockaddr_storage])
2882 fi
2883
2884 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
2885                 ac_cv_have___ss_family_in_struct_ss, [
2886         AC_TRY_COMPILE(
2887                 [
2888 #include <sys/types.h>
2889 #include <sys/socket.h>
2890                 ],
2891                 [ struct sockaddr_storage s; s.__ss_family = 1; ],
2892                 [ ac_cv_have___ss_family_in_struct_ss="yes" ],
2893                 [ ac_cv_have___ss_family_in_struct_ss="no" ]
2894         )
2895 ])
2896 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
2897         AC_DEFINE(HAVE___SS_FAMILY_IN_SS, 1,
2898                 [Fields in struct sockaddr_storage])
2899 fi
2900
2901 AC_CACHE_CHECK([for pw_class field in struct passwd],
2902                 ac_cv_have_pw_class_in_struct_passwd, [
2903         AC_TRY_COMPILE(
2904                 [
2905 #include <pwd.h>
2906                 ],
2907                 [ struct passwd p; p.pw_class = 0; ],
2908                 [ ac_cv_have_pw_class_in_struct_passwd="yes" ],
2909                 [ ac_cv_have_pw_class_in_struct_passwd="no" ]
2910         )
2911 ])
2912 if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
2913         AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD, 1,
2914                 [Define if your password has a pw_class field])
2915 fi
2916
2917 AC_CACHE_CHECK([for pw_expire field in struct passwd],
2918                 ac_cv_have_pw_expire_in_struct_passwd, [
2919         AC_TRY_COMPILE(
2920                 [
2921 #include <pwd.h>
2922                 ],
2923                 [ struct passwd p; p.pw_expire = 0; ],
2924                 [ ac_cv_have_pw_expire_in_struct_passwd="yes" ],
2925                 [ ac_cv_have_pw_expire_in_struct_passwd="no" ]
2926         )
2927 ])
2928 if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
2929         AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD, 1,
2930                 [Define if your password has a pw_expire field])
2931 fi
2932
2933 AC_CACHE_CHECK([for pw_change field in struct passwd],
2934                 ac_cv_have_pw_change_in_struct_passwd, [
2935         AC_TRY_COMPILE(
2936                 [
2937 #include <pwd.h>
2938                 ],
2939                 [ struct passwd p; p.pw_change = 0; ],
2940                 [ ac_cv_have_pw_change_in_struct_passwd="yes" ],
2941                 [ ac_cv_have_pw_change_in_struct_passwd="no" ]
2942         )
2943 ])
2944 if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
2945         AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD, 1,
2946                 [Define if your password has a pw_change field])
2947 fi
2948
2949 dnl make sure we're using the real structure members and not defines
2950 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
2951                 ac_cv_have_accrights_in_msghdr, [
2952         AC_COMPILE_IFELSE(
2953                 [
2954 #include <sys/types.h>
2955 #include <sys/socket.h>
2956 #include <sys/uio.h>
2957 int main() {
2958 #ifdef msg_accrights
2959 #error "msg_accrights is a macro"
2960 exit(1);
2961 #endif
2962 struct msghdr m;
2963 m.msg_accrights = 0;
2964 exit(0);
2965 }
2966                 ],
2967                 [ ac_cv_have_accrights_in_msghdr="yes" ],
2968                 [ ac_cv_have_accrights_in_msghdr="no" ]
2969         )
2970 ])
2971 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
2972         AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR, 1,
2973                 [Define if your system uses access rights style
2974                 file descriptor passing])
2975 fi
2976
2977 AC_CACHE_CHECK([for msg_control field in struct msghdr],
2978                 ac_cv_have_control_in_msghdr, [
2979         AC_COMPILE_IFELSE(
2980                 [
2981 #include <sys/types.h>
2982 #include <sys/socket.h>
2983 #include <sys/uio.h>
2984 int main() {
2985 #ifdef msg_control
2986 #error "msg_control is a macro"
2987 exit(1);
2988 #endif
2989 struct msghdr m;
2990 m.msg_control = 0;
2991 exit(0);
2992 }
2993                 ],
2994                 [ ac_cv_have_control_in_msghdr="yes" ],
2995                 [ ac_cv_have_control_in_msghdr="no" ]
2996         )
2997 ])
2998 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
2999         AC_DEFINE(HAVE_CONTROL_IN_MSGHDR, 1,
3000                 [Define if your system uses ancillary data style
3001                 file descriptor passing])
3002 fi
3003
3004 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
3005         AC_TRY_LINK([],
3006                 [ extern char *__progname; printf("%s", __progname); ],
3007                 [ ac_cv_libc_defines___progname="yes" ],
3008                 [ ac_cv_libc_defines___progname="no" ]
3009         )
3010 ])
3011 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
3012         AC_DEFINE(HAVE___PROGNAME, 1, [Define if libc defines __progname])
3013 fi
3014
3015 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
3016         AC_TRY_LINK([
3017 #include <stdio.h>
3018 ],
3019                 [ printf("%s", __FUNCTION__); ],
3020                 [ ac_cv_cc_implements___FUNCTION__="yes" ],
3021                 [ ac_cv_cc_implements___FUNCTION__="no" ]
3022         )
3023 ])
3024 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
3025         AC_DEFINE(HAVE___FUNCTION__, 1,
3026                 [Define if compiler implements __FUNCTION__])
3027 fi
3028
3029 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
3030         AC_TRY_LINK([
3031 #include <stdio.h>
3032 ],
3033                 [ printf("%s", __func__); ],
3034                 [ ac_cv_cc_implements___func__="yes" ],
3035                 [ ac_cv_cc_implements___func__="no" ]
3036         )
3037 ])
3038 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
3039         AC_DEFINE(HAVE___func__, 1, [Define if compiler implements __func__])
3040 fi
3041
3042 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
3043         AC_TRY_LINK(
3044                 [#include <stdarg.h>
3045                  va_list x,y;],
3046                 [va_copy(x,y);],
3047                 [ ac_cv_have_va_copy="yes" ],
3048                 [ ac_cv_have_va_copy="no" ]
3049         )
3050 ])
3051 if test "x$ac_cv_have_va_copy" = "xyes" ; then
3052         AC_DEFINE(HAVE_VA_COPY, 1, [Define if va_copy exists])
3053 fi
3054
3055 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
3056         AC_TRY_LINK(
3057                 [#include <stdarg.h>
3058                  va_list x,y;],
3059                 [__va_copy(x,y);],
3060                 [ ac_cv_have___va_copy="yes" ],
3061                 [ ac_cv_have___va_copy="no" ]
3062         )
3063 ])
3064 if test "x$ac_cv_have___va_copy" = "xyes" ; then
3065         AC_DEFINE(HAVE___VA_COPY, 1, [Define if __va_copy exists])
3066 fi
3067
3068 AC_CACHE_CHECK([whether getopt has optreset support],
3069                 ac_cv_have_getopt_optreset, [
3070         AC_TRY_LINK(
3071                 [
3072 #include <getopt.h>
3073                 ],
3074                 [ extern int optreset; optreset = 0; ],
3075                 [ ac_cv_have_getopt_optreset="yes" ],
3076                 [ ac_cv_have_getopt_optreset="no" ]
3077         )
3078 ])
3079 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
3080         AC_DEFINE(HAVE_GETOPT_OPTRESET, 1,
3081                 [Define if your getopt(3) defines and uses optreset])
3082 fi
3083
3084 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
3085         AC_TRY_LINK([],
3086                 [ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);],
3087                 [ ac_cv_libc_defines_sys_errlist="yes" ],
3088                 [ ac_cv_libc_defines_sys_errlist="no" ]
3089         )
3090 ])
3091 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
3092         AC_DEFINE(HAVE_SYS_ERRLIST, 1,
3093                 [Define if your system defines sys_errlist[]])
3094 fi
3095
3096
3097 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
3098         AC_TRY_LINK([],
3099                 [ extern int sys_nerr; printf("%i", sys_nerr);],
3100                 [ ac_cv_libc_defines_sys_nerr="yes" ],
3101                 [ ac_cv_libc_defines_sys_nerr="no" ]
3102         )
3103 ])
3104 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
3105         AC_DEFINE(HAVE_SYS_NERR, 1, [Define if your system defines sys_nerr])
3106 fi
3107
3108 SCARD_MSG="no"
3109 # Check whether user wants sectok support
3110 AC_ARG_WITH(sectok,
3111         [  --with-sectok           Enable smartcard support using libsectok],
3112         [
3113                 if test "x$withval" != "xno" ; then
3114                         if test "x$withval" != "xyes" ; then
3115                                 CPPFLAGS="$CPPFLAGS -I${withval}"
3116                                 LDFLAGS="$LDFLAGS -L${withval}"
3117                                 if test ! -z "$need_dash_r" ; then
3118                                         LDFLAGS="$LDFLAGS -R${withval}"
3119                                 fi
3120                                 if test ! -z "$blibpath" ; then
3121                                         blibpath="$blibpath:${withval}"
3122                                 fi
3123                         fi
3124                         AC_CHECK_HEADERS(sectok.h)
3125                         if test "$ac_cv_header_sectok_h" != yes; then
3126                                 AC_MSG_ERROR(Can't find sectok.h)
3127                         fi
3128                         AC_CHECK_LIB(sectok, sectok_open)
3129                         if test "$ac_cv_lib_sectok_sectok_open" != yes; then
3130                                 AC_MSG_ERROR(Can't find libsectok)
3131                         fi
3132                         AC_DEFINE(SMARTCARD, 1,
3133                                 [Define if you want smartcard support])
3134                         AC_DEFINE(USE_SECTOK, 1,
3135                                 [Define if you want smartcard support
3136                                 using sectok])
3137                         SCARD_MSG="yes, using sectok"
3138                 fi
3139         ]
3140 )
3141
3142 # Check whether user wants OpenSC support
3143 OPENSC_CONFIG="no"
3144 AC_ARG_WITH(opensc,
3145         [  --with-opensc[[=PFX]]     Enable smartcard support using OpenSC (optionally in PATH)],
3146         [
3147             if test "x$withval" != "xno" ; then
3148                 if test "x$withval" != "xyes" ; then
3149                         OPENSC_CONFIG=$withval/bin/opensc-config
3150                 else
3151                         AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
3152                 fi
3153                 if test "$OPENSC_CONFIG" != "no"; then
3154                         LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
3155                         LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
3156                         CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
3157                         LIBS="$LIBS $LIBOPENSC_LIBS"
3158                         AC_DEFINE(SMARTCARD)
3159                         AC_DEFINE(USE_OPENSC, 1,
3160                                 [Define if you want smartcard support
3161                                 using OpenSC])
3162                         SCARD_MSG="yes, using OpenSC"
3163                 fi
3164             fi
3165         ]
3166 )
3167
3168 # Check libraries needed by DNS fingerprint support
3169 AC_SEARCH_LIBS(getrrsetbyname, resolv,
3170         [AC_DEFINE(HAVE_GETRRSETBYNAME, 1,
3171                 [Define if getrrsetbyname() exists])],
3172         [
3173                 # Needed by our getrrsetbyname()
3174                 AC_SEARCH_LIBS(res_query, resolv)
3175                 AC_SEARCH_LIBS(dn_expand, resolv)
3176                 AC_MSG_CHECKING(if res_query will link)
3177                 AC_TRY_LINK_FUNC(res_query, AC_MSG_RESULT(yes),
3178                    [AC_MSG_RESULT(no)
3179                     saved_LIBS="$LIBS"
3180                     LIBS="$LIBS -lresolv"
3181                     AC_MSG_CHECKING(for res_query in -lresolv)
3182                     AC_LINK_IFELSE([
3183 #include <resolv.h>
3184 int main()
3185 {
3186         res_query (0, 0, 0, 0, 0);
3187         return 0;
3188 }
3189                         ],
3190                         [LIBS="$LIBS -lresolv"
3191                          AC_MSG_RESULT(yes)],
3192                         [LIBS="$saved_LIBS"
3193                          AC_MSG_RESULT(no)])
3194                     ])
3195                 AC_CHECK_FUNCS(_getshort _getlong)
3196                 AC_CHECK_DECLS([_getshort, _getlong], , ,
3197                     [#include <sys/types.h>
3198                     #include <arpa/nameser.h>])
3199                 AC_CHECK_MEMBER(HEADER.ad,
3200                         [AC_DEFINE(HAVE_HEADER_AD, 1,
3201                             [Define if HEADER.ad exists in arpa/nameser.h])],,
3202                         [#include <arpa/nameser.h>])
3203         ])
3204
3205 AC_MSG_CHECKING(if struct __res_state _res is an extern)
3206 AC_LINK_IFELSE([
3207 #include <stdio.h>
3208 #if HAVE_SYS_TYPES_H
3209 # include <sys/types.h>
3210 #endif
3211 #include <netinet/in.h>
3212 #include <arpa/nameser.h>
3213 #include <resolv.h>
3214 extern struct __res_state _res;
3215 int main() { return 0; }
3216                 ],
3217                 [AC_MSG_RESULT(yes)
3218                  AC_DEFINE(HAVE__RES_EXTERN, 1,
3219                     [Define if you have struct __res_state _res as an extern])
3220                 ],
3221                 [ AC_MSG_RESULT(no) ]
3222 )
3223
3224 # Check whether user wants SELinux support
3225 SELINUX_MSG="no"
3226 LIBSELINUX=""
3227 AC_ARG_WITH(selinux,
3228         [  --with-selinux   Enable SELinux support],
3229         [ if test "x$withval" != "xno" ; then
3230                 save_LIBS="$LIBS"
3231                 AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
3232                 SELINUX_MSG="yes"
3233                 AC_CHECK_HEADER([selinux/selinux.h], ,
3234                     AC_MSG_ERROR(SELinux support requires selinux.h header))
3235                 AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
3236                     AC_MSG_ERROR(SELinux support requires libselinux library))
3237                 SSHDLIBS="$SSHDLIBS $LIBSELINUX"
3238                 AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
3239                 LIBS="$save_LIBS"
3240         fi ]
3241 )
3242
3243 # Check whether user wants Kerberos 5 support
3244 KRB5_MSG="no"
3245 AC_ARG_WITH(kerberos5,
3246         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
3247         [ if test "x$withval" != "xno" ; then
3248                 if test "x$withval" = "xyes" ; then
3249                         KRB5ROOT="/usr/local"
3250                 else
3251                         KRB5ROOT=${withval}
3252                 fi
3253
3254                 AC_DEFINE(KRB5, 1, [Define if you want Kerberos 5 support])
3255                 KRB5_MSG="yes"
3256
3257                 AC_MSG_CHECKING(for krb5-config)
3258                 if test -x  $KRB5ROOT/bin/krb5-config ; then
3259                         KRB5CONF=$KRB5ROOT/bin/krb5-config
3260                         AC_MSG_RESULT($KRB5CONF)
3261
3262                         AC_MSG_CHECKING(for gssapi support)
3263                         if $KRB5CONF | grep gssapi >/dev/null ; then
3264                                 AC_MSG_RESULT(yes)
3265                                 AC_DEFINE(GSSAPI, 1,
3266                                         [Define this if you want GSSAPI
3267                                         support in the version 2 protocol])
3268                                 k5confopts=gssapi
3269                         else
3270                                 AC_MSG_RESULT(no)
3271                                 k5confopts=""
3272                         fi
3273                         K5CFLAGS="`$KRB5CONF --cflags $k5confopts`"
3274                         K5LIBS="`$KRB5CONF --libs $k5confopts`"
3275                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
3276                         AC_MSG_CHECKING(whether we are using Heimdal)
3277                         AC_TRY_COMPILE([ #include <krb5.h> ],
3278                                        [ char *tmp = heimdal_version; ],
3279                                        [ AC_MSG_RESULT(yes)
3280                                          AC_DEFINE(HEIMDAL, 1,
3281                                         [Define this if you are using the
3282                                         Heimdal version of Kerberos V5]) ],
3283                                          AC_MSG_RESULT(no)
3284                         )
3285                 else
3286                         AC_MSG_RESULT(no)
3287                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
3288                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
3289                         AC_MSG_CHECKING(whether we are using Heimdal)
3290                         AC_TRY_COMPILE([ #include <krb5.h> ],
3291                                        [ char *tmp = heimdal_version; ],
3292                                        [ AC_MSG_RESULT(yes)
3293                                          AC_DEFINE(HEIMDAL)
3294                                          K5LIBS="-lkrb5 -ldes"
3295                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
3296                                          AC_CHECK_LIB(roken, net_write,
3297                                            [K5LIBS="$K5LIBS -lroken"])
3298                                        ],
3299                                        [ AC_MSG_RESULT(no)
3300                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
3301                                        ]
3302                         )
3303                         AC_SEARCH_LIBS(dn_expand, resolv)
3304
3305                         AC_CHECK_LIB(gssapi,gss_init_sec_context,
3306                                 [ AC_DEFINE(GSSAPI)
3307                                   K5LIBS="-lgssapi $K5LIBS" ],
3308                                 [ AC_CHECK_LIB(gssapi_krb5,gss_init_sec_context,
3309                                         [ AC_DEFINE(GSSAPI)
3310                                           K5LIBS="-lgssapi_krb5 $K5LIBS" ],
3311                                         AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]),
3312                                         $K5LIBS)
3313                                 ],
3314                                 $K5LIBS)
3315
3316                         AC_CHECK_HEADER(gssapi.h, ,
3317                                 [ unset ac_cv_header_gssapi_h
3318                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3319                                   AC_CHECK_HEADERS(gssapi.h, ,
3320                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
3321                                   )
3322                                 ]
3323                         )
3324
3325                         oldCPP="$CPPFLAGS"
3326                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3327                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3328                                         [ CPPFLAGS="$oldCPP" ])
3329
3330                 fi
3331                 if test ! -z "$need_dash_r" ; then
3332                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
3333                 fi
3334                 if test ! -z "$blibpath" ; then
3335                         blibpath="$blibpath:${KRB5ROOT}/lib"
3336                 fi
3337
3338                 AC_CHECK_HEADERS(gssapi.h gssapi/gssapi.h)
3339                 AC_CHECK_HEADERS(gssapi_krb5.h gssapi/gssapi_krb5.h)
3340                 AC_CHECK_HEADERS(gssapi_generic.h gssapi/gssapi_generic.h)
3341
3342                 LIBS="$LIBS $K5LIBS"
3343                 AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS, 1,
3344                         [Define this if you want to use libkafs' AFS support]))
3345         fi
3346         ]
3347 )
3348
3349 # Looking for programs, paths and files
3350
3351 PRIVSEP_PATH=/var/empty
3352 AC_ARG_WITH(privsep-path,
3353         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
3354         [
3355                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3356                     test "x${withval}" != "xyes"; then
3357                         PRIVSEP_PATH=$withval
3358                 fi
3359         ]
3360 )
3361 AC_SUBST(PRIVSEP_PATH)
3362
3363 AC_ARG_WITH(xauth,
3364         [  --with-xauth=PATH       Specify path to xauth program ],
3365         [
3366                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3367                     test "x${withval}" != "xyes"; then
3368                         xauth_path=$withval
3369                 fi
3370         ],
3371         [
3372                 TestPath="$PATH"
3373                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
3374                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
3375                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
3376                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
3377                 AC_PATH_PROG(xauth_path, xauth, , $TestPath)
3378                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
3379                         xauth_path="/usr/openwin/bin/xauth"
3380                 fi
3381         ]
3382 )
3383
3384 STRIP_OPT=-s
3385 AC_ARG_ENABLE(strip,
3386         [  --disable-strip         Disable calling strip(1) on install],
3387         [
3388                 if test "x$enableval" = "xno" ; then
3389                         STRIP_OPT=
3390                 fi
3391         ]
3392 )
3393 AC_SUBST(STRIP_OPT)
3394
3395 if test -z "$xauth_path" ; then
3396         XAUTH_PATH="undefined"
3397         AC_SUBST(XAUTH_PATH)
3398 else
3399         AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path",
3400                 [Define if xauth is found in your path])
3401         XAUTH_PATH=$xauth_path
3402         AC_SUBST(XAUTH_PATH)
3403 fi
3404
3405 # Check for mail directory (last resort if we cannot get it from headers)
3406 if test ! -z "$MAIL" ; then
3407         maildir=`dirname $MAIL`
3408         AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir",
3409                 [Set this to your mail directory if you don't have maillock.h])
3410 fi
3411
3412 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
3413         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
3414         disable_ptmx_check=yes
3415 fi
3416 if test -z "$no_dev_ptmx" ; then
3417         if test "x$disable_ptmx_check" != "xyes" ; then
3418                 AC_CHECK_FILE("/dev/ptmx",
3419                         [
3420                                 AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX, 1,
3421                                         [Define if you have /dev/ptmx])
3422                                 have_dev_ptmx=1
3423                         ]
3424                 )
3425         fi
3426 fi
3427
3428 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
3429         AC_CHECK_FILE("/dev/ptc",
3430                 [
3431                         AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC, 1,
3432                                 [Define if you have /dev/ptc])
3433                         have_dev_ptc=1
3434                 ]
3435         )
3436 else
3437         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
3438 fi
3439
3440 # Options from here on. Some of these are preset by platform above
3441 AC_ARG_WITH(mantype,
3442         [  --with-mantype=man|cat|doc  Set man page type],
3443         [
3444                 case "$withval" in
3445                 man|cat|doc)
3446                         MANTYPE=$withval
3447                         ;;
3448                 *)
3449                         AC_MSG_ERROR(invalid man type: $withval)
3450                         ;;
3451                 esac
3452         ]
3453 )
3454 if test -z "$MANTYPE"; then
3455         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
3456         AC_PATH_PROGS(NROFF, nroff awf, /bin/false, $TestPath)
3457         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
3458                 MANTYPE=doc
3459         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
3460                 MANTYPE=man
3461         else
3462                 MANTYPE=cat
3463         fi
3464 fi
3465 AC_SUBST(MANTYPE)
3466 if test "$MANTYPE" = "doc"; then
3467         mansubdir=man;
3468 else
3469         mansubdir=$MANTYPE;
3470 fi
3471 AC_SUBST(mansubdir)
3472
3473 # Check whether to enable MD5 passwords
3474 MD5_MSG="no"
3475 AC_ARG_WITH(md5-passwords,
3476         [  --with-md5-passwords    Enable use of MD5 passwords],
3477         [
3478                 if test "x$withval" != "xno" ; then
3479                         AC_DEFINE(HAVE_MD5_PASSWORDS, 1,
3480                                 [Define if you want to allow MD5 passwords])
3481                         MD5_MSG="yes"
3482                 fi
3483         ]
3484 )
3485
3486 # Whether to disable shadow password support
3487 AC_ARG_WITH(shadow,
3488         [  --without-shadow        Disable shadow password support],
3489         [
3490                 if test "x$withval" = "xno" ; then
3491                         AC_DEFINE(DISABLE_SHADOW)
3492                         disable_shadow=yes
3493                 fi
3494         ]
3495 )
3496
3497 if test -z "$disable_shadow" ; then
3498         AC_MSG_CHECKING([if the systems has expire shadow information])
3499         AC_TRY_COMPILE(
3500         [
3501 #include <sys/types.h>
3502 #include <shadow.h>
3503         struct spwd sp;
3504         ],[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ],
3505         [ sp_expire_available=yes ], []
3506         )
3507
3508         if test "x$sp_expire_available" = "xyes" ; then
3509                 AC_MSG_RESULT(yes)
3510                 AC_DEFINE(HAS_SHADOW_EXPIRE, 1,
3511                     [Define if you want to use shadow password expire field])
3512         else
3513                 AC_MSG_RESULT(no)
3514         fi
3515 fi
3516
3517 # Use ip address instead of hostname in $DISPLAY
3518 if test ! -z "$IPADDR_IN_DISPLAY" ; then
3519         DISPLAY_HACK_MSG="yes"
3520         AC_DEFINE(IPADDR_IN_DISPLAY, 1,
3521                 [Define if you need to use IP address
3522                 instead of hostname in $DISPLAY])
3523 else
3524         DISPLAY_HACK_MSG="no"
3525         AC_ARG_WITH(ipaddr-display,
3526                 [  --with-ipaddr-display   Use ip address instead of hostname in \$DISPLAY],
3527                 [
3528                         if test "x$withval" != "xno" ; then
3529                                 AC_DEFINE(IPADDR_IN_DISPLAY)
3530                                 DISPLAY_HACK_MSG="yes"
3531                         fi
3532                 ]
3533         )
3534 fi
3535
3536 # check for /etc/default/login and use it if present.
3537 AC_ARG_ENABLE(etc-default-login,
3538         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
3539         [ if test "x$enableval" = "xno"; then
3540                 AC_MSG_NOTICE([/etc/default/login handling disabled])
3541                 etc_default_login=no
3542           else
3543                 etc_default_login=yes
3544           fi ],
3545         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
3546           then
3547                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
3548                 etc_default_login=no
3549           else
3550                 etc_default_login=yes
3551           fi ]
3552 )
3553
3554 if test "x$etc_default_login" != "xno"; then
3555         AC_CHECK_FILE("/etc/default/login",
3556             [ external_path_file=/etc/default/login ])
3557         if test "x$external_path_file" = "x/etc/default/login"; then
3558                 AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN, 1,
3559                         [Define if your system has /etc/default/login])
3560         fi
3561 fi
3562
3563 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
3564 if test $ac_cv_func_login_getcapbool = "yes" && \
3565         test $ac_cv_header_login_cap_h = "yes" ; then
3566         external_path_file=/etc/login.conf
3567 fi
3568
3569 # Whether to mess with the default path
3570 SERVER_PATH_MSG="(default)"
3571 AC_ARG_WITH(default-path,
3572         [  --with-default-path=    Specify default \$PATH environment for server],
3573         [
3574                 if test "x$external_path_file" = "x/etc/login.conf" ; then
3575                         AC_MSG_WARN([
3576 --with-default-path=PATH has no effect on this system.
3577 Edit /etc/login.conf instead.])
3578                 elif test "x$withval" != "xno" ; then
3579                         if test ! -z "$external_path_file" ; then
3580                                 AC_MSG_WARN([
3581 --with-default-path=PATH will only be used if PATH is not defined in
3582 $external_path_file .])
3583                         fi
3584                         user_path="$withval"
3585                         SERVER_PATH_MSG="$withval"
3586                 fi
3587         ],
3588         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
3589                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
3590         else
3591                 if test ! -z "$external_path_file" ; then
3592                         AC_MSG_WARN([
3593 If PATH is defined in $external_path_file, ensure the path to scp is included,
3594 otherwise scp will not work.])
3595                 fi
3596                 AC_RUN_IFELSE(
3597                         [AC_LANG_SOURCE([[
3598 /* find out what STDPATH is */
3599 #include <stdio.h>
3600 #ifdef HAVE_PATHS_H
3601 # include <paths.h>
3602 #endif
3603 #ifndef _PATH_STDPATH
3604 # ifdef _PATH_USERPATH  /* Irix */
3605 #  define _PATH_STDPATH _PATH_USERPATH
3606 # else
3607 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
3608 # endif
3609 #endif
3610 #include <sys/types.h>
3611 #include <sys/stat.h>
3612 #include <fcntl.h>
3613 #define DATA "conftest.stdpath"
3614
3615 main()
3616 {
3617         FILE *fd;
3618         int rc;
3619
3620         fd = fopen(DATA,"w");
3621         if(fd == NULL)
3622                 exit(1);
3623
3624         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
3625                 exit(1);
3626
3627         exit(0);
3628 }
3629                 ]])],
3630                 [ user_path=`cat conftest.stdpath` ],
3631                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
3632                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
3633         )
3634 # make sure $bindir is in USER_PATH so scp will work
3635                 t_bindir=`eval echo ${bindir}`
3636                 case $t_bindir in
3637                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
3638                 esac
3639                 case $t_bindir in
3640                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
3641                 esac
3642                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
3643                 if test $? -ne 0  ; then
3644                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
3645                         if test $? -ne 0  ; then
3646                                 user_path=$user_path:$t_bindir
3647                                 AC_MSG_RESULT(Adding $t_bindir to USER_PATH so scp will work)
3648                         fi
3649                 fi
3650         fi ]
3651 )
3652 if test "x$external_path_file" != "x/etc/login.conf" ; then
3653         AC_DEFINE_UNQUOTED(USER_PATH, "$user_path", [Specify default $PATH])
3654         AC_SUBST(user_path)
3655 fi
3656
3657 # Set superuser path separately to user path
3658 AC_ARG_WITH(superuser-path,
3659         [  --with-superuser-path=  Specify different path for super-user],
3660         [
3661                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3662                     test "x${withval}" != "xyes"; then
3663                         AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval",
3664                                 [Define if you want a different $PATH
3665                                 for the superuser])
3666                         superuser_path=$withval
3667                 fi
3668         ]
3669 )
3670
3671
3672 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
3673 IPV4_IN6_HACK_MSG="no"
3674 AC_ARG_WITH(4in6,
3675         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
3676         [
3677                 if test "x$withval" != "xno" ; then
3678                         AC_MSG_RESULT(yes)
3679                         AC_DEFINE(IPV4_IN_IPV6, 1,
3680                                 [Detect IPv4 in IPv6 mapped addresses
3681                                 and treat as IPv4])
3682                         IPV4_IN6_HACK_MSG="yes"
3683                 else
3684                         AC_MSG_RESULT(no)
3685                 fi
3686         ],[
3687                 if test "x$inet6_default_4in6" = "xyes"; then
3688                         AC_MSG_RESULT([yes (default)])
3689                         AC_DEFINE(IPV4_IN_IPV6)
3690                         IPV4_IN6_HACK_MSG="yes"
3691                 else
3692                         AC_MSG_RESULT([no (default)])
3693                 fi
3694         ]
3695 )
3696
3697 # Whether to enable BSD auth support
3698 BSD_AUTH_MSG=no
3699 AC_ARG_WITH(bsd-auth,
3700         [  --with-bsd-auth         Enable BSD auth support],
3701         [
3702                 if test "x$withval" != "xno" ; then
3703                         AC_DEFINE(BSD_AUTH, 1,
3704                                 [Define if you have BSD auth support])
3705                         BSD_AUTH_MSG=yes
3706                 fi
3707         ]
3708 )
3709
3710 # Where to place sshd.pid
3711 piddir=/var/run
3712 # make sure the directory exists
3713 if test ! -d $piddir ; then
3714         piddir=`eval echo ${sysconfdir}`
3715         case $piddir in
3716                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
3717         esac
3718 fi
3719
3720 AC_ARG_WITH(pid-dir,
3721         [  --with-pid-dir=PATH     Specify location of ssh.pid file],
3722         [
3723                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3724                     test "x${withval}" != "xyes"; then
3725                         piddir=$withval
3726                         if test ! -d $piddir ; then
3727                         AC_MSG_WARN([** no $piddir directory on this system **])
3728                         fi
3729                 fi
3730         ]
3731 )
3732
3733 AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir", [Specify location of ssh.pid])
3734 AC_SUBST(piddir)
3735
3736 dnl allow user to disable some login recording features
3737 AC_ARG_ENABLE(lastlog,
3738         [  --disable-lastlog       disable use of lastlog even if detected [no]],
3739         [
3740                 if test "x$enableval" = "xno" ; then
3741                         AC_DEFINE(DISABLE_LASTLOG)
3742                 fi
3743         ]
3744 )
3745 AC_ARG_ENABLE(utmp,
3746         [  --disable-utmp          disable use of utmp even if detected [no]],
3747         [
3748                 if test "x$enableval" = "xno" ; then
3749                         AC_DEFINE(DISABLE_UTMP)
3750                 fi
3751         ]
3752 )
3753 AC_ARG_ENABLE(utmpx,
3754         [  --disable-utmpx         disable use of utmpx even if detected [no]],
3755         [
3756                 if test "x$enableval" = "xno" ; then
3757                         AC_DEFINE(DISABLE_UTMPX, 1,
3758                                 [Define if you don't want to use utmpx])
3759                 fi
3760         ]
3761 )
3762 AC_ARG_ENABLE(wtmp,
3763         [  --disable-wtmp          disable use of wtmp even if detected [no]],
3764         [
3765                 if test "x$enableval" = "xno" ; then
3766                         AC_DEFINE(DISABLE_WTMP)
3767                 fi
3768         ]
3769 )
3770 AC_ARG_ENABLE(wtmpx,
3771         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
3772         [
3773                 if test "x$enableval" = "xno" ; then
3774                         AC_DEFINE(DISABLE_WTMPX, 1,
3775                                 [Define if you don't want to use wtmpx])
3776                 fi
3777         ]
3778 )
3779 AC_ARG_ENABLE(libutil,
3780         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
3781         [
3782                 if test "x$enableval" = "xno" ; then
3783                         AC_DEFINE(DISABLE_LOGIN)
3784                 fi
3785         ]
3786 )
3787 AC_ARG_ENABLE(pututline,
3788         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
3789         [
3790                 if test "x$enableval" = "xno" ; then
3791                         AC_DEFINE(DISABLE_PUTUTLINE, 1,
3792                                 [Define if you don't want to use pututline()
3793                                 etc. to write [uw]tmp])
3794                 fi
3795         ]
3796 )
3797 AC_ARG_ENABLE(pututxline,
3798         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
3799         [
3800                 if test "x$enableval" = "xno" ; then
3801                         AC_DEFINE(DISABLE_PUTUTXLINE, 1,
3802                                 [Define if you don't want to use pututxline()
3803                                 etc. to write [uw]tmpx])
3804                 fi
3805         ]
3806 )
3807 AC_ARG_WITH(lastlog,
3808   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
3809         [
3810                 if test "x$withval" = "xno" ; then
3811                         AC_DEFINE(DISABLE_LASTLOG)
3812                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
3813                         conf_lastlog_location=$withval
3814                 fi
3815         ]
3816 )
3817
3818 dnl lastlog, [uw]tmpx? detection
3819 dnl  NOTE: set the paths in the platform section to avoid the
3820 dnl   need for command-line parameters
3821 dnl lastlog and [uw]tmp are subject to a file search if all else fails
3822
3823 dnl lastlog detection
3824 dnl  NOTE: the code itself will detect if lastlog is a directory
3825 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
3826 AC_TRY_COMPILE([
3827 #include <sys/types.h>
3828 #include <utmp.h>
3829 #ifdef HAVE_LASTLOG_H
3830 #  include <lastlog.h>
3831 #endif
3832 #ifdef HAVE_PATHS_H
3833 #  include <paths.h>
3834 #endif
3835 #ifdef HAVE_LOGIN_H
3836 # include <login.h>
3837 #endif
3838         ],
3839         [ char *lastlog = LASTLOG_FILE; ],
3840         [ AC_MSG_RESULT(yes) ],
3841         [
3842                 AC_MSG_RESULT(no)
3843                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
3844                 AC_TRY_COMPILE([
3845 #include <sys/types.h>
3846 #include <utmp.h>
3847 #ifdef HAVE_LASTLOG_H
3848 #  include <lastlog.h>
3849 #endif
3850 #ifdef HAVE_PATHS_H
3851 #  include <paths.h>
3852 #endif
3853                 ],
3854                 [ char *lastlog = _PATH_LASTLOG; ],
3855                 [ AC_MSG_RESULT(yes) ],
3856                 [
3857                         AC_MSG_RESULT(no)
3858                         system_lastlog_path=no
3859                 ])
3860         ]
3861 )
3862
3863 if test -z "$conf_lastlog_location"; then
3864         if test x"$system_lastlog_path" = x"no" ; then
3865                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
3866                                 if (test -d "$f" || test -f "$f") ; then
3867                                         conf_lastlog_location=$f
3868                                 fi
3869                 done
3870                 if test -z "$conf_lastlog_location"; then
3871                         AC_MSG_WARN([** Cannot find lastlog **])
3872                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
3873                 fi
3874         fi
3875 fi
3876
3877 if test -n "$conf_lastlog_location"; then
3878         AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location",
3879                 [Define if you want to specify the path to your lastlog file])
3880 fi
3881
3882 dnl utmp detection
3883 AC_MSG_CHECKING([if your system defines UTMP_FILE])
3884 AC_TRY_COMPILE([
3885 #include <sys/types.h>
3886 #include <utmp.h>
3887 #ifdef HAVE_PATHS_H
3888 #  include <paths.h>
3889 #endif
3890         ],
3891         [ char *utmp = UTMP_FILE; ],
3892         [ AC_MSG_RESULT(yes) ],
3893         [ AC_MSG_RESULT(no)
3894           system_utmp_path=no ]
3895 )
3896 if test -z "$conf_utmp_location"; then
3897         if test x"$system_utmp_path" = x"no" ; then
3898                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
3899                         if test -f $f ; then
3900                                 conf_utmp_location=$f
3901                         fi
3902                 done
3903                 if test -z "$conf_utmp_location"; then
3904                         AC_DEFINE(DISABLE_UTMP)
3905                 fi
3906         fi
3907 fi
3908 if test -n "$conf_utmp_location"; then
3909         AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location",
3910                 [Define if you want to specify the path to your utmp file])
3911 fi
3912
3913 dnl wtmp detection
3914 AC_MSG_CHECKING([if your system defines WTMP_FILE])
3915 AC_TRY_COMPILE([
3916 #include <sys/types.h>
3917 #include <utmp.h>
3918 #ifdef HAVE_PATHS_H
3919 #  include <paths.h>
3920 #endif
3921         ],
3922         [ char *wtmp = WTMP_FILE; ],
3923         [ AC_MSG_RESULT(yes) ],
3924         [ AC_MSG_RESULT(no)
3925           system_wtmp_path=no ]
3926 )
3927 if test -z "$conf_wtmp_location"; then
3928         if test x"$system_wtmp_path" = x"no" ; then
3929                 for f in /usr/adm/wtmp /var/log/wtmp; do
3930                         if test -f $f ; then
3931                                 conf_wtmp_location=$f
3932                         fi
3933                 done
3934                 if test -z "$conf_wtmp_location"; then
3935                         AC_DEFINE(DISABLE_WTMP)
3936                 fi
3937         fi
3938 fi
3939 if test -n "$conf_wtmp_location"; then
3940         AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location",
3941                 [Define if you want to specify the path to your wtmp file])
3942 fi
3943
3944
3945 dnl utmpx detection - I don't know any system so perverse as to require
3946 dnl  utmpx, but not define UTMPX_FILE (ditto wtmpx.) No doubt it's out
3947 dnl  there, though.
3948 AC_MSG_CHECKING([if your system defines UTMPX_FILE])
3949 AC_TRY_COMPILE([
3950 #include <sys/types.h>
3951 #include <utmp.h>
3952 #ifdef HAVE_UTMPX_H
3953 #include <utmpx.h>
3954 #endif
3955 #ifdef HAVE_PATHS_H
3956 #  include <paths.h>
3957 #endif
3958         ],
3959         [ char *utmpx = UTMPX_FILE; ],
3960         [ AC_MSG_RESULT(yes) ],
3961         [ AC_MSG_RESULT(no)
3962           system_utmpx_path=no ]
3963 )
3964 if test -z "$conf_utmpx_location"; then
3965         if test x"$system_utmpx_path" = x"no" ; then
3966                 AC_DEFINE(DISABLE_UTMPX)
3967         fi
3968 else
3969         AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
3970                 [Define if you want to specify the path to your utmpx file])
3971 fi
3972
3973 dnl wtmpx detection
3974 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
3975 AC_TRY_COMPILE([
3976 #include <sys/types.h>
3977 #include <utmp.h>
3978 #ifdef HAVE_UTMPX_H
3979 #include <utmpx.h>
3980 #endif
3981 #ifdef HAVE_PATHS_H
3982 #  include <paths.h>
3983 #endif
3984         ],
3985         [ char *wtmpx = WTMPX_FILE; ],
3986         [ AC_MSG_RESULT(yes) ],
3987         [ AC_MSG_RESULT(no)
3988           system_wtmpx_path=no ]
3989 )
3990 if test -z "$conf_wtmpx_location"; then
3991         if test x"$system_wtmpx_path" = x"no" ; then
3992                 AC_DEFINE(DISABLE_WTMPX)
3993         fi
3994 else
3995         AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location",
3996                 [Define if you want to specify the path to your wtmpx file])
3997 fi
3998
3999
4000 if test ! -z "$blibpath" ; then
4001         LDFLAGS="$LDFLAGS $blibflags$blibpath"
4002         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
4003 fi
4004
4005 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
4006 dnl Add now.
4007 CFLAGS="$CFLAGS $werror_flags"
4008
4009 AC_EXEEXT
4010 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
4011         openbsd-compat/Makefile openbsd-compat/regress/Makefile \
4012         scard/Makefile ssh_prng_cmds survey.sh])
4013 AC_OUTPUT
4014
4015 # Print summary of options
4016
4017 # Someone please show me a better way :)
4018 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
4019 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
4020 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
4021 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
4022 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
4023 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
4024 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
4025 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
4026 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
4027 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
4028
4029 echo ""
4030 echo "OpenSSH has been configured with the following options:"
4031 echo "                     User binaries: $B"
4032 echo "                   System binaries: $C"
4033 echo "               Configuration files: $D"
4034 echo "                   Askpass program: $E"
4035 echo "                      Manual pages: $F"
4036 echo "                          PID file: $G"
4037 echo "  Privilege separation chroot path: $H"
4038 if test "x$external_path_file" = "x/etc/login.conf" ; then
4039 echo "   At runtime, sshd will use the path defined in $external_path_file"
4040 echo "   Make sure the path to scp is present, otherwise scp will not work"
4041 else
4042 echo "            sshd default user PATH: $I"
4043         if test ! -z "$external_path_file"; then
4044 echo "   (If PATH is set in $external_path_file it will be used instead. If"
4045 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
4046         fi
4047 fi
4048 if test ! -z "$superuser_path" ; then
4049 echo "          sshd superuser user PATH: $J"
4050 fi
4051 echo "                    Manpage format: $MANTYPE"
4052 echo "                       PAM support: $PAM_MSG"
4053 echo "                   OSF SIA support: $SIA_MSG"
4054 echo "                 KerberosV support: $KRB5_MSG"
4055 echo "                   SELinux support: $SELINUX_MSG"
4056 echo "                 Smartcard support: $SCARD_MSG"
4057 echo "                     S/KEY support: $SKEY_MSG"
4058 echo "              TCP Wrappers support: $TCPW_MSG"
4059 echo "              MD5 password support: $MD5_MSG"
4060 echo "                   libedit support: $LIBEDIT_MSG"
4061 echo "  Solaris process contract support: $SPC_MSG"
4062 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
4063 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
4064 echo "                  BSD Auth support: $BSD_AUTH_MSG"
4065 echo "              Random number source: $RAND_MSG"
4066 if test ! -z "$USE_RAND_HELPER" ; then
4067 echo "     ssh-rand-helper collects from: $RAND_HELPER_MSG"
4068 fi
4069
4070 echo ""
4071
4072 echo "              Host: ${host}"
4073 echo "          Compiler: ${CC}"
4074 echo "    Compiler flags: ${CFLAGS}"
4075 echo "Preprocessor flags: ${CPPFLAGS}"
4076 echo "      Linker flags: ${LDFLAGS}"
4077 echo "         Libraries: ${LIBS}"
4078 if test ! -z "${SSHDLIBS}"; then
4079 echo "         +for sshd: ${SSHDLIBS}"
4080 fi
4081
4082 echo ""
4083
4084 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
4085         echo "SVR4 style packages are supported with \"make package\""
4086         echo ""
4087 fi
4088
4089 if test "x$PAM_MSG" = "xyes" ; then
4090         echo "PAM is enabled. You may need to install a PAM control file "
4091         echo "for sshd, otherwise password authentication may fail. "
4092         echo "Example PAM control files can be found in the contrib/ "
4093         echo "subdirectory"
4094         echo ""
4095 fi
4096
4097 if test ! -z "$RAND_HELPER_CMDHASH" ; then
4098         echo "WARNING: you are using the builtin random number collection "
4099         echo "service. Please read WARNING.RNG and request that your OS "
4100         echo "vendor includes kernel-based random number collection in "
4101         echo "future versions of your OS."
4102         echo ""
4103 fi
4104
4105 if test ! -z "$NO_PEERCHECK" ; then
4106         echo "WARNING: the operating system that you are using does not"
4107         echo "appear to support getpeereid(), getpeerucred() or the"
4108         echo "SO_PEERCRED getsockopt() option. These facilities are used to"
4109         echo "enforce security checks to prevent unauthorised connections to"
4110         echo "ssh-agent. Their absence increases the risk that a malicious"
4111         echo "user can connect to your agent."
4112         echo ""
4113 fi
4114
4115 if test "$AUDIT_MODULE" = "bsm" ; then
4116         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
4117         echo "See the Solaris section in README.platform for details."
4118 fi