configure.ac

   1 # $Id$
   2 #
   3 # Copyright (c) 1999-2004 Damien Miller
   4 #
   5 # Permission to use, copy, modify, and distribute this software for any
   6 # purpose with or without fee is hereby granted, provided that the above
   7 # copyright notice and this permission notice appear in all copies.
   8 #
   9 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16
  17 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
  18 AC_REVISION($Revision$)
  19 AC_CONFIG_SRCDIR([ssh.c])
  20
  21 AC_CONFIG_HEADER(config.h)
  22 AC_PROG_CC
  23 AC_CANONICAL_HOST
  24 AC_C_BIGENDIAN
  25
  26 # Checks for programs.
  27 AC_PROG_AWK
  28 AC_PROG_CPP
  29 AC_PROG_RANLIB
  30 AC_PROG_INSTALL
  31 AC_PROG_EGREP
  32 AC_PATH_PROG(AR, ar)
  33 AC_PATH_PROG(CAT, cat)
  34 AC_PATH_PROG(KILL, kill)
  35 AC_PATH_PROGS(PERL, perl5 perl)
  36 AC_PATH_PROG(SED, sed)
  37 AC_SUBST(PERL)
  38 AC_PATH_PROG(ENT, ent)
  39 AC_SUBST(ENT)
  40 AC_PATH_PROG(TEST_MINUS_S_SH, bash)
  41 AC_PATH_PROG(TEST_MINUS_S_SH, ksh)
  42 AC_PATH_PROG(TEST_MINUS_S_SH, sh)
  43 AC_PATH_PROG(SH, sh)
  44 AC_SUBST(TEST_SHELL,sh)
  45
  46 dnl for buildpkg.sh
  47 AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd,
  48         [/usr/sbin${PATH_SEPARATOR}/etc])
  49 AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd,
  50         [/usr/sbin${PATH_SEPARATOR}/etc])
  51 AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no)
  52 if test -x /sbin/sh; then
  53         AC_SUBST(STARTUP_SCRIPT_SHELL,/sbin/sh)
  54 else
  55         AC_SUBST(STARTUP_SCRIPT_SHELL,/bin/sh)
  56 fi
  57
  58 # System features
  59 AC_SYS_LARGEFILE
  60
  61 if test -z "$AR" ; then
  62         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
  63 fi
  64
  65 # Use LOGIN_PROGRAM from environment if possible
  66 if test ! -z "$LOGIN_PROGRAM" ; then
  67         AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM",
  68                 [If your header files don't define LOGIN_PROGRAM,
  69                 then use this (detected) from environment and PATH])
  70 else
  71         # Search for login
  72         AC_PATH_PROG(LOGIN_PROGRAM_FALLBACK, login)
  73         if test ! -z "$LOGIN_PROGRAM_FALLBACK" ; then
  74                 AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM_FALLBACK")
  75         fi
  76 fi
  77
  78 AC_PATH_PROG(PATH_PASSWD_PROG, passwd)
  79 if test ! -z "$PATH_PASSWD_PROG" ; then
  80         AC_DEFINE_UNQUOTED(_PATH_PASSWD_PROG, "$PATH_PASSWD_PROG",
  81                 [Full path of your "passwd" program])
  82 fi
  83
  84 if test -z "$LD" ; then
  85         LD=$CC
  86 fi
  87 AC_SUBST(LD)
  88
  89 AC_C_INLINE
  90
  91 AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
  92
  93 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
  94         CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
  95         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
  96         case $GCC_VER in
  97                 1.*) ;;
  98                 2.8* | 2.9*) CFLAGS="$CFLAGS -Wsign-compare" ;;
  99                 2.*) ;;
 100                 3.*) CFLAGS="$CFLAGS -Wsign-compare" ;;
 101                 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;;
 102                 *) ;;
 103         esac
 104
 105         if test -z "$have_llong_max"; then
 106                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 107                 unset ac_cv_have_decl_LLONG_MAX
 108                 saved_CFLAGS="$CFLAGS"
 109                 CFLAGS="$CFLAGS -std=gnu99"
 110                 AC_CHECK_DECL(LLONG_MAX,
 111                     [have_llong_max=1],
 112                     [CFLAGS="$saved_CFLAGS"],
 113                     [#include <limits.h>]
 114                 )
 115         fi
 116 fi
 117
 118 AC_ARG_WITH(rpath,
 119         [  --without-rpath         Disable auto-added -R linker paths],
 120         [
 121                 if test "x$withval" = "xno" ; then
 122                         need_dash_r=""
 123                 fi
 124                 if test "x$withval" = "xyes" ; then
 125                         need_dash_r=1
 126                 fi
 127         ]
 128 )
 129
 130 # Check for some target-specific stuff
 131 case "$host" in
 132 *-*-aix*)
 133         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 134         if (test -z "$blibpath"); then
 135                 blibpath="/usr/lib:/lib"
 136         fi
 137         saved_LDFLAGS="$LDFLAGS"
 138         for tryflags in -blibpath: -Wl,-blibpath: -Wl,-rpath, ;do
 139                 if (test -z "$blibflags"); then
 140                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 141                         AC_TRY_LINK([], [], [blibflags=$tryflags])
 142                 fi
 143         done
 144         if (test -z "$blibflags"); then
 145                 AC_MSG_RESULT(not found)
 146                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 147         else
 148                 AC_MSG_RESULT($blibflags)
 149         fi
 150         LDFLAGS="$saved_LDFLAGS"
 151         dnl Check for authenticate.  Might be in libs.a on older AIXes
 152         AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE, 1,
 153                 [Define if you want to enable AIX4's authenticate function])],
 154                 [AC_CHECK_LIB(s,authenticate,
 155                         [ AC_DEFINE(WITH_AIXAUTHENTICATE)
 156                                 LIBS="$LIBS -ls"
 157                         ])
 158                 ])
 159         dnl Check for various auth function declarations in headers.
 160         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 161             passwdexpired, setauthdb], , , [#include <usersec.h>])
 162         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 163         AC_CHECK_DECLS(loginfailed,
 164                  [AC_MSG_CHECKING(if loginfailed takes 4 arguments)
 165                   AC_TRY_COMPILE(
 166                         [#include <usersec.h>],
 167                         [(void)loginfailed("user","host","tty",0);],
 168                         [AC_MSG_RESULT(yes)
 169                          AC_DEFINE(AIX_LOGINFAILED_4ARG, 1,
 170                                 [Define if your AIX loginfailed() function
 171                                 takes 4 arguments (AIX >= 5.2)])],
 172                         [AC_MSG_RESULT(no)]
 173                 )],
 174                 [],
 175                 [#include <usersec.h>]
 176         )
 177         AC_CHECK_FUNCS(setauthdb)
 178         check_for_aix_broken_getaddrinfo=1
 179         AC_DEFINE(BROKEN_REALPATH, 1, [Define if you have a broken realpath.])
 180         AC_DEFINE(SETEUID_BREAKS_SETUID, 1,
 181             [Define if your platform breaks doing a seteuid before a setuid])
 182         AC_DEFINE(BROKEN_SETREUID, 1, [Define if your setreuid() is broken])
 183         AC_DEFINE(BROKEN_SETREGID, 1, [Define if your setregid() is broken])
 184         dnl AIX handles lastlog as part of its login message
 185         AC_DEFINE(DISABLE_LASTLOG, 1, [Define if you don't want to use lastlog])
 186         AC_DEFINE(LOGIN_NEEDS_UTMPX, 1,
 187                 [Some systems need a utmpx entry for /bin/login to work])
 188         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV,
 189                 [Define to a Set Process Title type if your system is
 190                 supported by bsd-setproctitle.c])
 191         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 192             [AIX 5.2 and 5.3 (and presumably newer) require this])
 193         AC_DEFINE(PTY_ZEROREAD, 1, [read(1) can return 0 for a non-closed fd])
 194         ;;
 195 *-*-cygwin*)
 196         check_for_libcrypt_later=1
 197         LIBS="$LIBS /usr/lib/textmode.o"
 198         AC_DEFINE(HAVE_CYGWIN, 1, [Define if you are on Cygwin])
 199         AC_DEFINE(USE_PIPES, 1, [Use PIPES instead of a socketpair()])
 200         AC_DEFINE(DISABLE_SHADOW, 1,
 201                 [Define if you want to disable shadow passwords])
 202         AC_DEFINE(IP_TOS_IS_BROKEN, 1,
 203                 [Define if your system choked on IP TOS setting])
 204         AC_DEFINE(NO_X11_UNIX_SOCKETS, 1,
 205                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 206         AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT, 1,
 207                 [Define if the concept of ports only accessible to
 208                 superusers isn't known])
 209         AC_DEFINE(DISABLE_FD_PASSING, 1,
 210                 [Define if your platform needs to skip post auth
 211                 file descriptor passing])
 212         ;;
 213 *-*-dgux*)
 214         AC_DEFINE(IP_TOS_IS_BROKEN)
 215         AC_DEFINE(SETEUID_BREAKS_SETUID)
 216         AC_DEFINE(BROKEN_SETREUID)
 217         AC_DEFINE(BROKEN_SETREGID)
 218         ;;
 219 *-*-darwin*)
 220         AC_MSG_CHECKING(if we have working getaddrinfo)
 221         AC_TRY_RUN([#include <mach-o/dyld.h>
 222 main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 223                 exit(0);
 224         else
 225                 exit(1);
 226 }], [AC_MSG_RESULT(working)],
 227         [AC_MSG_RESULT(buggy)
 228         AC_DEFINE(BROKEN_GETADDRINFO, 1, [getaddrinfo is broken (if present)])],
 229         [AC_MSG_RESULT(assume it is working)])
 230         AC_DEFINE(SETEUID_BREAKS_SETUID)
 231         AC_DEFINE(BROKEN_SETREUID)
 232         AC_DEFINE(BROKEN_SETREGID)
 233         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
 234                 [Define if your resolver libs need this for getrrsetbyname])
 235         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 236         AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 237             [Use tunnel device compatibility to OpenBSD])
 238         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 239             [Prepend the address family to IP tunnel traffic])
 240         ;;
 241 *-*-hpux*)
 242         # first we define all of the options common to all HP-UX releases
 243         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 244         IPADDR_IN_DISPLAY=yes
 245         AC_DEFINE(USE_PIPES)
 246         AC_DEFINE(LOGIN_NO_ENDOPT, 1,
 247             [Define if your login program cannot handle end of options ("--")])
 248         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 249         AC_DEFINE(LOCKED_PASSWD_STRING, "*",
 250                 [String used in /etc/passwd to denote locked account])
 251         AC_DEFINE(SPT_TYPE,SPT_PSTAT)
 252         MAIL="/var/mail/username"
 253         LIBS="$LIBS -lsec"
 254         AC_CHECK_LIB(xnet, t_error, ,
 255             AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
 256
 257         # next, we define all of the options specific to major releases
 258         case "$host" in
 259         *-*-hpux10*)
 260                 if test -z "$GCC"; then
 261                         CFLAGS="$CFLAGS -Ae"
 262                 fi
 263                 ;;
 264         *-*-hpux11*)
 265                 AC_DEFINE(PAM_SUN_CODEBASE, 1,
 266                         [Define if you are using Solaris-derived PAM which
 267                         passes pam_messages to the conversation function
 268                         with an extra level of indirection])
 269                 AC_DEFINE(DISABLE_UTMP, 1,
 270                         [Define if you don't want to use utmp])
 271                 AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
 272                 check_for_hpux_broken_getaddrinfo=1
 273                 check_for_conflicting_getspnam=1
 274                 ;;
 275         esac
 276
 277         # lastly, we define options specific to minor releases
 278         case "$host" in
 279         *-*-hpux10.26)
 280                 AC_DEFINE(HAVE_SECUREWARE, 1,
 281                         [Define if you have SecureWare-based
 282                         protected password database])
 283                 disable_ptmx_check=yes
 284                 LIBS="$LIBS -lsecpw"
 285                 ;;
 286         esac
 287         ;;
 288 *-*-irix5*)
 289         PATH="$PATH:/usr/etc"
 290         AC_DEFINE(BROKEN_INET_NTOA, 1,
 291                 [Define if you system's inet_ntoa is busted
 292                 (e.g. Irix gcc issue)])
 293         AC_DEFINE(SETEUID_BREAKS_SETUID)
 294         AC_DEFINE(BROKEN_SETREUID)
 295         AC_DEFINE(BROKEN_SETREGID)
 296         AC_DEFINE(WITH_ABBREV_NO_TTY, 1,
 297                 [Define if you shouldn't strip 'tty' from your
 298                 ttyname in [uw]tmp])
 299         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 300         ;;
 301 *-*-irix6*)
 302         PATH="$PATH:/usr/etc"
 303         AC_DEFINE(WITH_IRIX_ARRAY, 1,
 304                 [Define if you have/want arrays
 305                 (cluster-wide session managment, not C arrays)])
 306         AC_DEFINE(WITH_IRIX_PROJECT, 1,
 307                 [Define if you want IRIX project management])
 308         AC_DEFINE(WITH_IRIX_AUDIT, 1,
 309                 [Define if you want IRIX audit trails])
 310         AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS, 1,
 311                 [Define if you want IRIX kernel jobs])])
 312         AC_DEFINE(BROKEN_INET_NTOA)
 313         AC_DEFINE(SETEUID_BREAKS_SETUID)
 314         AC_DEFINE(BROKEN_SETREUID)
 315         AC_DEFINE(BROKEN_SETREGID)
 316         AC_DEFINE(BROKEN_UPDWTMPX, 1, [updwtmpx is broken (if present)])
 317         AC_DEFINE(WITH_ABBREV_NO_TTY)
 318         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 319         ;;
 320 *-*-linux*)
 321         no_dev_ptmx=1
 322         check_for_libcrypt_later=1
 323         check_for_openpty_ctty_bug=1
 324         AC_DEFINE(DONT_TRY_OTHER_AF, 1, [Workaround more Linux IPv6 quirks])
 325         AC_DEFINE(PAM_TTY_KLUDGE, 1,
 326                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 327         AC_DEFINE(LOCKED_PASSWD_PREFIX, "!",
 328                 [String used in /etc/passwd to denote locked account])
 329         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
 330         AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM,
 331                 [Define to whatever link() returns for "not supported"
 332                 if it doesn't return EOPNOTSUPP.])
 333         AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
 334         AC_DEFINE(USE_BTMP)
 335         inet6_default_4in6=yes
 336         case `uname -r` in
 337         1.*|2.0.*)
 338                 AC_DEFINE(BROKEN_CMSG_TYPE, 1,
 339                         [Define if cmsg_type is not passed correctly])
 340                 ;;
 341         esac
 342         # tun(4) forwarding compat code
 343         AC_CHECK_HEADERS(linux/if_tun.h)
 344         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 345                 AC_DEFINE(SSH_TUN_LINUX, 1,
 346                     [Open tunnel devices the Linux tun/tap way])
 347                 AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 348                     [Use tunnel device compatibility to OpenBSD])
 349                 AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 350                     [Prepend the address family to IP tunnel traffic])
 351         fi
 352         ;;
 353 mips-sony-bsd|mips-sony-newsos4)
 354         AC_DEFINE(NEED_SETPGRP, 1, [Need setpgrp to acquire controlling tty])
 355         SONY=1
 356         ;;
 357 *-*-netbsd*)
 358         check_for_libcrypt_before=1
 359         if test "x$withval" != "xno" ; then
 360                 need_dash_r=1
 361         fi
 362         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 363         AC_CHECK_HEADER([net/if_tap.h], ,
 364             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 365         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 366             [Prepend the address family to IP tunnel traffic])
 367         ;;
 368 *-*-freebsd*)
 369         check_for_libcrypt_later=1
 370         AC_DEFINE(LOCKED_PASSWD_PREFIX, "*LOCKED*", [Account locked with pw(1)])
 371         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 372         AC_CHECK_HEADER([net/if_tap.h], ,
 373             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 374         ;;
 375 *-*-bsdi*)
 376         AC_DEFINE(SETEUID_BREAKS_SETUID)
 377         AC_DEFINE(BROKEN_SETREUID)
 378         AC_DEFINE(BROKEN_SETREGID)
 379         ;;
 380 *-next-*)
 381         conf_lastlog_location="/usr/adm/lastlog"
 382         conf_utmp_location=/etc/utmp
 383         conf_wtmp_location=/usr/adm/wtmp
 384         MAIL=/usr/spool/mail
 385         AC_DEFINE(HAVE_NEXT, 1, [Define if you are on NeXT])
 386         AC_DEFINE(BROKEN_REALPATH)
 387         AC_DEFINE(USE_PIPES)
 388         AC_DEFINE(BROKEN_SAVED_UIDS, 1, [Needed for NeXT])
 389         ;;
 390 *-*-openbsd*)
 391         AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
 392         AC_DEFINE(HAVE_ATTRIBUTE__BOUNDED__, 1, [OpenBSD's gcc has bounded])
 393         AC_DEFINE(SSH_TUN_OPENBSD, 1, [Open tunnel devices the OpenBSD way])
 394         ;;
 395 *-*-solaris*)
 396         if test "x$withval" != "xno" ; then
 397                 need_dash_r=1
 398         fi
 399         AC_DEFINE(PAM_SUN_CODEBASE)
 400         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 401         AC_DEFINE(LOGIN_NEEDS_TERM, 1,
 402                 [Some versions of /bin/login need the TERM supplied
 403                 on the commandline])
 404         AC_DEFINE(PAM_TTY_KLUDGE)
 405         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 406                 [Define if pam_chauthtok wants real uid set
 407                 to the unpriv'ed user])
 408         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 409         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 410         AC_DEFINE(SSHD_ACQUIRES_CTTY, 1,
 411                 [Define if sshd somehow reacquires a controlling TTY
 412                 after setsid()])
 413         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd
 414                 in case the name is longer than 8 chars])
 415         external_path_file=/etc/default/login
 416         # hardwire lastlog location (can't detect it on some versions)
 417         conf_lastlog_location="/var/adm/lastlog"
 418         AC_MSG_CHECKING(for obsolete utmp and wtmp in solaris2.x)
 419         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 420         if test "$sol2ver" -ge 8; then
 421                 AC_MSG_RESULT(yes)
 422                 AC_DEFINE(DISABLE_UTMP)
 423                 AC_DEFINE(DISABLE_WTMP, 1,
 424                         [Define if you don't want to use wtmp])
 425         else
 426                 AC_MSG_RESULT(no)
 427         fi
 428         ;;
 429 *-*-sunos4*)
 430         CPPFLAGS="$CPPFLAGS -DSUNOS4"
 431         AC_CHECK_FUNCS(getpwanam)
 432         AC_DEFINE(PAM_SUN_CODEBASE)
 433         conf_utmp_location=/etc/utmp
 434         conf_wtmp_location=/var/adm/wtmp
 435         conf_lastlog_location=/var/adm/lastlog
 436         AC_DEFINE(USE_PIPES)
 437         ;;
 438 *-ncr-sysv*)
 439         LIBS="$LIBS -lc89"
 440         AC_DEFINE(USE_PIPES)
 441         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 442         AC_DEFINE(SETEUID_BREAKS_SETUID)
 443         AC_DEFINE(BROKEN_SETREUID)
 444         AC_DEFINE(BROKEN_SETREGID)
 445         ;;
 446 *-sni-sysv*)
 447         # /usr/ucblib MUST NOT be searched on ReliantUNIX
 448         AC_CHECK_LIB(dl, dlsym, ,)
 449         # -lresolv needs to be at the end of LIBS or DNS lookups break
 450         AC_CHECK_LIB(resolv, res_query, [ LIBS="$LIBS -lresolv" ])
 451         IPADDR_IN_DISPLAY=yes
 452         AC_DEFINE(USE_PIPES)
 453         AC_DEFINE(IP_TOS_IS_BROKEN)
 454         AC_DEFINE(SETEUID_BREAKS_SETUID)
 455         AC_DEFINE(BROKEN_SETREUID)
 456         AC_DEFINE(BROKEN_SETREGID)
 457         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 458         external_path_file=/etc/default/login
 459         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
 460         # Attention: always take care to bind libsocket and libnsl before libc,
 461         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
 462         ;;
 463 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 464 *-*-sysv4.2*)
 465         CFLAGS="$CFLAGS -Dva_list=_VA_LIST"
 466         AC_DEFINE(USE_PIPES)
 467         AC_DEFINE(SETEUID_BREAKS_SETUID)
 468         AC_DEFINE(BROKEN_SETREUID)
 469         AC_DEFINE(BROKEN_SETREGID)
 470         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
 471         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 472         ;;
 473 # UnixWare 7.x, OpenUNIX 8
 474 *-*-sysv5*)
 475         check_for_libcrypt_later=1
 476         AC_DEFINE(UNIXWARE_LONG_PASSWORDS, 1, [Support passwords > 8 chars])
 477         AC_DEFINE(USE_PIPES)
 478         AC_DEFINE(SETEUID_BREAKS_SETUID)
 479         AC_DEFINE(BROKEN_SETREUID)
 480         AC_DEFINE(BROKEN_SETREGID)
 481         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 482         case "$host" in
 483         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
 484                 TEST_SHELL=/u95/bin/sh
 485                 AC_DEFINE(BROKEN_LIBIAF, 1,
 486                         [ia_uinfo routines not supported by OS yet])
 487                 ;;
 488         *)      AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 489                 ;;
 490         esac
 491         ;;
 492 *-*-sysv*)
 493         ;;
 494 # SCO UNIX and OEM versions of SCO UNIX
 495 *-*-sco3.2v4*)
 496         AC_MSG_ERROR("This Platform is no longer supported.")
 497         ;;
 498 # SCO OpenServer 5.x
 499 *-*-sco3.2v5*)
 500         if test -z "$GCC"; then
 501                 CFLAGS="$CFLAGS -belf"
 502         fi
 503         LIBS="$LIBS -lprot -lx -ltinfo -lm"
 504         no_dev_ptmx=1
 505         AC_DEFINE(USE_PIPES)
 506         AC_DEFINE(HAVE_SECUREWARE)
 507         AC_DEFINE(DISABLE_SHADOW)
 508         AC_DEFINE(DISABLE_FD_PASSING)
 509         AC_DEFINE(SETEUID_BREAKS_SETUID)
 510         AC_DEFINE(BROKEN_SETREUID)
 511         AC_DEFINE(BROKEN_SETREGID)
 512         AC_DEFINE(WITH_ABBREV_NO_TTY)
 513         AC_DEFINE(BROKEN_UPDWTMPX)
 514         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 515         AC_CHECK_FUNCS(getluid setluid)
 516         MANTYPE=man
 517         TEST_SHELL=ksh
 518         ;;
 519 *-*-unicosmk*)
 520         AC_DEFINE(NO_SSH_LASTLOG, 1,
 521                 [Define if you don't want to use lastlog in session.c])
 522         AC_DEFINE(SETEUID_BREAKS_SETUID)
 523         AC_DEFINE(BROKEN_SETREUID)
 524         AC_DEFINE(BROKEN_SETREGID)
 525         AC_DEFINE(USE_PIPES)
 526         AC_DEFINE(DISABLE_FD_PASSING)
 527         LDFLAGS="$LDFLAGS"
 528         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 529         MANTYPE=cat
 530         ;;
 531 *-*-unicosmp*)
 532         AC_DEFINE(SETEUID_BREAKS_SETUID)
 533         AC_DEFINE(BROKEN_SETREUID)
 534         AC_DEFINE(BROKEN_SETREGID)
 535         AC_DEFINE(WITH_ABBREV_NO_TTY)
 536         AC_DEFINE(USE_PIPES)
 537         AC_DEFINE(DISABLE_FD_PASSING)
 538         LDFLAGS="$LDFLAGS"
 539         LIBS="$LIBS -lgen -lacid -ldb"
 540         MANTYPE=cat
 541         ;;
 542 *-*-unicos*)
 543         AC_DEFINE(SETEUID_BREAKS_SETUID)
 544         AC_DEFINE(BROKEN_SETREUID)
 545         AC_DEFINE(BROKEN_SETREGID)
 546         AC_DEFINE(USE_PIPES)
 547         AC_DEFINE(DISABLE_FD_PASSING)
 548         AC_DEFINE(NO_SSH_LASTLOG)
 549         LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
 550         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 551         MANTYPE=cat
 552         ;;
 553 *-dec-osf*)
 554         AC_MSG_CHECKING(for Digital Unix SIA)
 555         no_osfsia=""
 556         AC_ARG_WITH(osfsia,
 557                 [  --with-osfsia           Enable Digital Unix SIA],
 558                 [
 559                         if test "x$withval" = "xno" ; then
 560                                 AC_MSG_RESULT(disabled)
 561                                 no_osfsia=1
 562                         fi
 563                 ],
 564         )
 565         if test -z "$no_osfsia" ; then
 566                 if test -f /etc/sia/matrix.conf; then
 567                         AC_MSG_RESULT(yes)
 568                         AC_DEFINE(HAVE_OSF_SIA, 1,
 569                                 [Define if you have Digital Unix Security
 570                                 Integration Architecture])
 571                         AC_DEFINE(DISABLE_LOGIN, 1,
 572                                 [Define if you don't want to use your
 573                                 system's login() call])
 574                         AC_DEFINE(DISABLE_FD_PASSING)
 575                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
 576                 else
 577                         AC_MSG_RESULT(no)
 578                         AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin",
 579                           [String used in /etc/passwd to denote locked account])
 580                 fi
 581         fi
 582         AC_DEFINE(BROKEN_GETADDRINFO)
 583         AC_DEFINE(SETEUID_BREAKS_SETUID)
 584         AC_DEFINE(BROKEN_SETREUID)
 585         AC_DEFINE(BROKEN_SETREGID)
 586         ;;
 587
 588 *-*-nto-qnx*)
 589         AC_DEFINE(USE_PIPES)
 590         AC_DEFINE(NO_X11_UNIX_SOCKETS)
 591         AC_DEFINE(MISSING_NFDBITS, 1, [Define on *nto-qnx systems])
 592         AC_DEFINE(MISSING_HOWMANY, 1, [Define on *nto-qnx systems])
 593         AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
 594         AC_DEFINE(DISABLE_LASTLOG)
 595         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 596         enable_etc_default_login=no     # has incompatible /etc/default/login
 597         ;;
 598
 599 *-*-ultrix*)
 600         AC_DEFINE(BROKEN_GETGROUPS, 1, [getgroups(0,NULL) will return -1])
 601         AC_DEFINE(BROKEN_MMAP, 1, [Ultrix mmap can't map files])
 602         AC_DEFINE(NEED_SETPGRP)
 603         AC_DEFINE(HAVE_SYS_SYSLOG_H, 1, [Force use of sys/syslog.h on Ultrix])
 604         ;;
 605
 606 *-*-lynxos)
 607         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
 608         AC_DEFINE(MISSING_HOWMANY)
 609         AC_DEFINE(BROKEN_SETVBUF, 1, [LynxOS has broken setvbuf() implementation])
 610         ;;
 611 esac
 612
 613 # Allow user to specify flags
 614 AC_ARG_WITH(cflags,
 615         [  --with-cflags           Specify additional flags to pass to compiler],
 616         [
 617                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 618                     test "x${withval}" != "xyes"; then
 619                         CFLAGS="$CFLAGS $withval"
 620                 fi
 621         ]
 622 )
 623 AC_ARG_WITH(cppflags,
 624         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 625         [
 626                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 627                     test "x${withval}" != "xyes"; then
 628                         CPPFLAGS="$CPPFLAGS $withval"
 629                 fi
 630         ]
 631 )
 632 AC_ARG_WITH(ldflags,
 633         [  --with-ldflags          Specify additional flags to pass to linker],
 634         [
 635                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 636                     test "x${withval}" != "xyes"; then
 637                         LDFLAGS="$LDFLAGS $withval"
 638                 fi
 639         ]
 640 )
 641 AC_ARG_WITH(libs,
 642         [  --with-libs             Specify additional libraries to link with],
 643         [
 644                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 645                     test "x${withval}" != "xyes"; then
 646                         LIBS="$LIBS $withval"
 647                 fi
 648         ]
 649 )
 650 AC_ARG_WITH(Werror,
 651         [  --with-Werror           Build main code with -Werror],
 652         [
 653                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 654                         werror_flags="-Werror"
 655                         if test "x${withval}" != "xyes"; then
 656                                 werror_flags="$withval"
 657                         fi
 658                 fi
 659         ]
 660 )
 661
 662 AC_MSG_CHECKING(compiler and flags for sanity)
 663 AC_RUN_IFELSE(
 664         [AC_LANG_SOURCE([
 665 #include <stdio.h>
 666 int main(){exit(0);}
 667         ])],
 668         [       AC_MSG_RESULT(yes) ],
 669         [
 670                 AC_MSG_RESULT(no)
 671                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
 672         ],
 673         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
 674 )
 675
 676 dnl Checks for header files.
 677 AC_CHECK_HEADERS( \
 678         bstring.h \
 679         crypt.h \
 680         crypto/sha2.h \
 681         dirent.h \
 682         endian.h \
 683         features.h \
 684         floatingpoint.h \
 685         getopt.h \
 686         glob.h \
 687         ia.h \
 688         iaf.h \
 689         limits.h \
 690         login.h \
 691         maillock.h \
 692         ndir.h \
 693         net/if_tun.h \
 694         netdb.h \
 695         netgroup.h \
 696         pam/pam_appl.h \
 697         paths.h \
 698         pty.h \
 699         readpassphrase.h \
 700         rpc/types.h \
 701         security/pam_appl.h \
 702         sha2.h \
 703         shadow.h \
 704         stddef.h \
 705         stdint.h \
 706         string.h \
 707         strings.h \
 708         sys/audit.h \
 709         sys/bitypes.h \
 710         sys/bsdtty.h \
 711         sys/cdefs.h \
 712         sys/dir.h \
 713         sys/mman.h \
 714         sys/ndir.h \
 715         sys/prctl.h \
 716         sys/pstat.h \
 717         sys/select.h \
 718         sys/stat.h \
 719         sys/stream.h \
 720         sys/stropts.h \
 721         sys/strtio.h \
 722         sys/sysmacros.h \
 723         sys/time.h \
 724         sys/timers.h \
 725         sys/un.h \
 726         time.h \
 727         tmpdir.h \
 728         ttyent.h \
 729         unistd.h \
 730         usersec.h \
 731         util.h \
 732         utime.h \
 733         utmp.h \
 734         utmpx.h \
 735         vis.h \
 736 )
 737
 738 # lastlog.h requires sys/time.h to be included first on Solaris
 739 AC_CHECK_HEADERS(lastlog.h, [], [], [
 740 #ifdef HAVE_SYS_TIME_H
 741 # include <sys/time.h>
 742 #endif
 743 ])
 744
 745 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 746 AC_CHECK_HEADERS(sys/ptms.h, [], [], [
 747 #ifdef HAVE_SYS_STREAM_H
 748 # include <sys/stream.h>
 749 #endif
 750 ])
 751
 752 # login_cap.h requires sys/types.h on NetBSD
 753 AC_CHECK_HEADERS(login_cap.h, [], [], [
 754 #include <sys/types.h>
 755 ])
 756
 757 # Checks for libraries.
 758 AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
 759 AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt))
 760
 761 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
 762 AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
 763         AC_CHECK_LIB(gen, dirname,[
 764                 AC_CACHE_CHECK([for broken dirname],
 765                         ac_cv_have_broken_dirname, [
 766                         save_LIBS="$LIBS"
 767                         LIBS="$LIBS -lgen"
 768                         AC_RUN_IFELSE(
 769                                 [AC_LANG_SOURCE([[
 770 #include <libgen.h>
 771 #include <string.h>
 772
 773 int main(int argc, char **argv) {
 774     char *s, buf[32];
 775
 776     strncpy(buf,"/etc", 32);
 777     s = dirname(buf);
 778     if (!s || strncmp(s, "/", 32) != 0) {
 779         exit(1);
 780     } else {
 781         exit(0);
 782     }
 783 }
 784                                 ]])],
 785                                 [ ac_cv_have_broken_dirname="no" ],
 786                                 [ ac_cv_have_broken_dirname="yes" ],
 787                                 [ ac_cv_have_broken_dirname="no" ],
 788                         )
 789                         LIBS="$save_LIBS"
 790                 ])
 791                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
 792                         LIBS="$LIBS -lgen"
 793                         AC_DEFINE(HAVE_DIRNAME)
 794                         AC_CHECK_HEADERS(libgen.h)
 795                 fi
 796         ])
 797 ])
 798
 799 AC_CHECK_FUNC(getspnam, ,
 800         AC_CHECK_LIB(gen, getspnam, LIBS="$LIBS -lgen"))
 801 AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME, 1,
 802         [Define if you have the basename function.]))
 803
 804 dnl zlib is required
 805 AC_ARG_WITH(zlib,
 806         [  --with-zlib=PATH        Use zlib in PATH],
 807         [ if test "x$withval" = "xno" ; then
 808                 AC_MSG_ERROR([*** zlib is required ***])
 809           elif test "x$withval" != "xyes"; then
 810                 if test -d "$withval/lib"; then
 811                         if test -n "${need_dash_r}"; then
 812                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
 813                         else
 814                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
 815                         fi
 816                 else
 817                         if test -n "${need_dash_r}"; then
 818                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
 819                         else
 820                                 LDFLAGS="-L${withval} ${LDFLAGS}"
 821                         fi
 822                 fi
 823                 if test -d "$withval/include"; then
 824                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
 825                 else
 826                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
 827                 fi
 828         fi ]
 829 )
 830
 831 AC_CHECK_LIB(z, deflate, ,
 832         [
 833                 saved_CPPFLAGS="$CPPFLAGS"
 834                 saved_LDFLAGS="$LDFLAGS"
 835                 save_LIBS="$LIBS"
 836                 dnl Check default zlib install dir
 837                 if test -n "${need_dash_r}"; then
 838                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
 839                 else
 840                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
 841                 fi
 842                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
 843                 LIBS="$LIBS -lz"
 844                 AC_TRY_LINK_FUNC(deflate, AC_DEFINE(HAVE_LIBZ),
 845                         [
 846                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
 847                         ]
 848                 )
 849         ]
 850 )
 851 AC_CHECK_HEADER([zlib.h], ,AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***]))
 852
 853 AC_ARG_WITH(zlib-version-check,
 854         [  --without-zlib-version-check Disable zlib version check],
 855         [  if test "x$withval" = "xno" ; then
 856                 zlib_check_nonfatal=1
 857            fi
 858         ]
 859 )
 860
 861 AC_MSG_CHECKING(for possibly buggy zlib)
 862 AC_RUN_IFELSE([AC_LANG_SOURCE([[
 863 #include <stdio.h>
 864 #include <zlib.h>
 865 int main()
 866 {
 867         int a=0, b=0, c=0, d=0, n, v;
 868         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
 869         if (n != 3 && n != 4)
 870                 exit(1);
 871         v = a*1000000 + b*10000 + c*100 + d;
 872         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
 873
 874         /* 1.1.4 is OK */
 875         if (a == 1 && b == 1 && c >= 4)
 876                 exit(0);
 877
 878         /* 1.2.3 and up are OK */
 879         if (v >= 1020300)
 880                 exit(0);
 881
 882         exit(2);
 883 }
 884         ]])],
 885         AC_MSG_RESULT(no),
 886         [ AC_MSG_RESULT(yes)
 887           if test -z "$zlib_check_nonfatal" ; then
 888                 AC_MSG_ERROR([*** zlib too old - check config.log ***
 889 Your reported zlib version has known security problems.  It's possible your
 890 vendor has fixed these problems without changing the version number.  If you
 891 are sure this is the case, you can disable the check by running
 892 "./configure --without-zlib-version-check".
 893 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
 894 See http://www.gzip.org/zlib/ for details.])
 895           else
 896                 AC_MSG_WARN([zlib version may have security problems])
 897           fi
 898         ],
 899         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
 900 )
 901
 902 dnl UnixWare 2.x
 903 AC_CHECK_FUNC(strcasecmp,
 904         [], [ AC_CHECK_LIB(resolv, strcasecmp, LIBS="$LIBS -lresolv") ]
 905 )
 906 AC_CHECK_FUNCS(utimes,
 907         [], [ AC_CHECK_LIB(c89, utimes, [AC_DEFINE(HAVE_UTIMES)
 908                                         LIBS="$LIBS -lc89"]) ]
 909 )
 910
 911 dnl    Checks for libutil functions
 912 AC_CHECK_HEADERS(libutil.h)
 913 AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1,
 914         [Define if your libraries define login()])])
 915 AC_CHECK_FUNCS(logout updwtmp logwtmp)
 916
 917 AC_FUNC_STRFTIME
 918
 919 # Check for ALTDIRFUNC glob() extension
 920 AC_MSG_CHECKING(for GLOB_ALTDIRFUNC support)
 921 AC_EGREP_CPP(FOUNDIT,
 922         [
 923                 #include <glob.h>
 924                 #ifdef GLOB_ALTDIRFUNC
 925                 FOUNDIT
 926                 #endif
 927         ],
 928         [
 929                 AC_DEFINE(GLOB_HAS_ALTDIRFUNC, 1,
 930                         [Define if your system glob() function has
 931                         the GLOB_ALTDIRFUNC extension])
 932                 AC_MSG_RESULT(yes)
 933         ],
 934         [
 935                 AC_MSG_RESULT(no)
 936         ]
 937 )
 938
 939 # Check for g.gl_matchc glob() extension
 940 AC_MSG_CHECKING(for gl_matchc field in glob_t)
 941 AC_TRY_COMPILE(
 942         [ #include <glob.h> ],
 943         [glob_t g; g.gl_matchc = 1;],
 944         [
 945                 AC_DEFINE(GLOB_HAS_GL_MATCHC, 1,
 946                         [Define if your system glob() function has
 947                         gl_matchc options in glob_t])
 948                 AC_MSG_RESULT(yes)
 949         ],
 950         [
 951                 AC_MSG_RESULT(no)
 952         ]
 953 )
 954
 955 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
 956 AC_RUN_IFELSE(
 957         [AC_LANG_SOURCE([[
 958 #include <sys/types.h>
 959 #include <dirent.h>
 960 int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
 961         ]])],
 962         [AC_MSG_RESULT(yes)],
 963         [
 964                 AC_MSG_RESULT(no)
 965                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME, 1,
 966                         [Define if your struct dirent expects you to
 967                         allocate extra space for d_name])
 968         ],
 969         [
 970                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
 971                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
 972         ]
 973 )
 974
 975 AC_MSG_CHECKING([for /proc/pid/fd directory])
 976 if test -d "/proc/$$/fd" ; then
 977         AC_DEFINE(HAVE_PROC_PID, 1, [Define if you have /proc/$pid/fd])
 978         AC_MSG_RESULT(yes)
 979 else
 980         AC_MSG_RESULT(no)
 981 fi
 982
 983 # Check whether user wants S/Key support
 984 SKEY_MSG="no"
 985 AC_ARG_WITH(skey,
 986         [  --with-skey[[=PATH]]      Enable S/Key support (optionally in PATH)],
 987         [
 988                 if test "x$withval" != "xno" ; then
 989
 990                         if test "x$withval" != "xyes" ; then
 991                                 CPPFLAGS="$CPPFLAGS -I${withval}/include"
 992                                 LDFLAGS="$LDFLAGS -L${withval}/lib"
 993                         fi
 994
 995                         AC_DEFINE(SKEY, 1, [Define if you want S/Key support])
 996                         LIBS="-lskey $LIBS"
 997                         SKEY_MSG="yes"
 998
 999                         AC_MSG_CHECKING([for s/key support])
1000                         AC_LINK_IFELSE(
1001                                 [AC_LANG_SOURCE([[
1002 #include <stdio.h>
1003 #include <skey.h>
1004 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
1005                                 ]])],
1006                                 [AC_MSG_RESULT(yes)],
1007                                 [
1008                                         AC_MSG_RESULT(no)
1009                                         AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
1010                                 ])
1011                         AC_MSG_CHECKING(if skeychallenge takes 4 arguments)
1012                         AC_TRY_COMPILE(
1013                                 [#include <stdio.h>
1014                                  #include <skey.h>],
1015                                 [(void)skeychallenge(NULL,"name","",0);],
1016                                 [AC_MSG_RESULT(yes)
1017                                  AC_DEFINE(SKEYCHALLENGE_4ARG, 1,
1018                                         [Define if your skeychallenge()
1019                                         function takes 4 arguments (NetBSD)])],
1020                                 [AC_MSG_RESULT(no)]
1021                         )
1022                 fi
1023         ]
1024 )
1025
1026 # Check whether user wants TCP wrappers support
1027 TCPW_MSG="no"
1028 AC_ARG_WITH(tcp-wrappers,
1029         [  --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1030         [
1031                 if test "x$withval" != "xno" ; then
1032                         saved_LIBS="$LIBS"
1033                         saved_LDFLAGS="$LDFLAGS"
1034                         saved_CPPFLAGS="$CPPFLAGS"
1035                         if test -n "${withval}" && \
1036                             test "x${withval}" != "xyes"; then
1037                                 if test -d "${withval}/lib"; then
1038                                         if test -n "${need_dash_r}"; then
1039                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1040                                         else
1041                                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1042                                         fi
1043                                 else
1044                                         if test -n "${need_dash_r}"; then
1045                                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1046                                         else
1047                                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1048                                         fi
1049                                 fi
1050                                 if test -d "${withval}/include"; then
1051                                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1052                                 else
1053                                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1054                                 fi
1055                         fi
1056                         LIBWRAP="-lwrap"
1057                         LIBS="$LIBWRAP $LIBS"
1058                         AC_MSG_CHECKING(for libwrap)
1059                         AC_TRY_LINK(
1060                                 [
1061 #include <sys/types.h>
1062 #include <sys/socket.h>
1063 #include <netinet/in.h>
1064 #include <tcpd.h>
1065                                         int deny_severity = 0, allow_severity = 0;
1066                                 ],
1067                                 [hosts_access(0);],
1068                                 [
1069                                         AC_MSG_RESULT(yes)
1070                                         AC_DEFINE(LIBWRAP, 1,
1071                                                 [Define if you want
1072                                                 TCP Wrappers support])
1073                                         AC_SUBST(LIBWRAP)
1074                                         TCPW_MSG="yes"
1075                                 ],
1076                                 [
1077                                         AC_MSG_ERROR([*** libwrap missing])
1078                                 ]
1079                         )
1080                         LIBS="$saved_LIBS"
1081                 fi
1082         ]
1083 )
1084
1085 # Check whether user wants libedit support
1086 LIBEDIT_MSG="no"
1087 AC_ARG_WITH(libedit,
1088         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1089         [ if test "x$withval" != "xno" ; then
1090                 if test "x$withval" != "xyes"; then
1091                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1092                         if test -n "${need_dash_r}"; then
1093                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1094                         else
1095                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1096                         fi
1097                 fi
1098                 AC_CHECK_LIB(edit, el_init,
1099                         [ AC_DEFINE(USE_LIBEDIT, 1, [Use libedit for sftp])
1100                           LIBEDIT="-ledit -lcurses"
1101                           LIBEDIT_MSG="yes"
1102                           AC_SUBST(LIBEDIT)
1103                         ],
1104                         [ AC_MSG_ERROR(libedit not found) ],
1105                         [ -lcurses ]
1106                 )
1107                 AC_MSG_CHECKING(if libedit version is compatible)
1108                 AC_COMPILE_IFELSE(
1109                     [AC_LANG_SOURCE([[
1110 #include <histedit.h>
1111 int main(void)
1112 {
1113         int i = H_SETSIZE;
1114         el_init("", NULL, NULL, NULL);
1115         exit(0);
1116 }
1117                     ]])],
1118                     [ AC_MSG_RESULT(yes) ],
1119                     [ AC_MSG_RESULT(no)
1120                       AC_MSG_ERROR(libedit version is not compatible) ]
1121                 )
1122         fi ]
1123 )
1124
1125 AUDIT_MODULE=none
1126 AC_ARG_WITH(audit,
1127         [  --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)],
1128         [
1129           AC_MSG_CHECKING(for supported audit module)
1130           case "$withval" in
1131           bsm)
1132                 AC_MSG_RESULT(bsm)
1133                 AUDIT_MODULE=bsm
1134                 dnl    Checks for headers, libs and functions
1135                 AC_CHECK_HEADERS(bsm/audit.h, [],
1136                     [AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)])
1137                 AC_CHECK_LIB(bsm, getaudit, [],
1138                     [AC_MSG_ERROR(BSM enabled and required library not found)])
1139                 AC_CHECK_FUNCS(getaudit, [],
1140                     [AC_MSG_ERROR(BSM enabled and required function not found)])
1141                 # These are optional
1142                 AC_CHECK_FUNCS(getaudit_addr)
1143                 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
1144                 ;;
1145           debug)
1146                 AUDIT_MODULE=debug
1147                 AC_MSG_RESULT(debug)
1148                 AC_DEFINE(SSH_AUDIT_EVENTS, 1, Use audit debugging module)
1149                 ;;
1150           no)
1151                 AC_MSG_RESULT(no)
1152                 ;;
1153           *)
1154                 AC_MSG_ERROR([Unknown audit module $withval])
1155                 ;;
1156         esac ]
1157 )
1158
1159 dnl    Checks for library functions. Please keep in alphabetical order
1160 AC_CHECK_FUNCS( \
1161         arc4random \
1162         asprintf \
1163         b64_ntop \
1164         __b64_ntop \
1165         b64_pton \
1166         __b64_pton \
1167         bcopy \
1168         bindresvport_sa \
1169         clock \
1170         closefrom \
1171         dirfd \
1172         fchmod \
1173         fchown \
1174         freeaddrinfo \
1175         futimes \
1176         getaddrinfo \
1177         getcwd \
1178         getgrouplist \
1179         getnameinfo \
1180         getopt \
1181         getpeereid \
1182         _getpty \
1183         getrlimit \
1184         getttyent \
1185         glob \
1186         inet_aton \
1187         inet_ntoa \
1188         inet_ntop \
1189         innetgr \
1190         login_getcapbool \
1191         md5_crypt \
1192         memmove \
1193         mkdtemp \
1194         mmap \
1195         ngetaddrinfo \
1196         nsleep \
1197         ogetaddrinfo \
1198         openlog_r \
1199         openpty \
1200         prctl \
1201         pstat \
1202         readpassphrase \
1203         realpath \
1204         recvmsg \
1205         rresvport_af \
1206         sendmsg \
1207         setdtablesize \
1208         setegid \
1209         setenv \
1210         seteuid \
1211         setgroups \
1212         setlogin \
1213         setpcred \
1214         setproctitle \
1215         setregid \
1216         setreuid \
1217         setrlimit \
1218         setsid \
1219         setvbuf \
1220         sigaction \
1221         sigvec \
1222         snprintf \
1223         socketpair \
1224         strdup \
1225         strerror \
1226         strlcat \
1227         strlcpy \
1228         strmode \
1229         strnvis \
1230         strtonum \
1231         strtoll \
1232         strtoul \
1233         sysconf \
1234         tcgetpgrp \
1235         truncate \
1236         unsetenv \
1237         updwtmpx \
1238         vasprintf \
1239         vhangup \
1240         vsnprintf \
1241         waitpid \
1242 )
1243
1244 # IRIX has a const char return value for gai_strerror()
1245 AC_CHECK_FUNCS(gai_strerror,[
1246         AC_DEFINE(HAVE_GAI_STRERROR)
1247         AC_TRY_COMPILE([
1248 #include <sys/types.h>
1249 #include <sys/socket.h>
1250 #include <netdb.h>
1251
1252 const char *gai_strerror(int);],[
1253 char *str;
1254
1255 str = gai_strerror(0);],[
1256                 AC_DEFINE(HAVE_CONST_GAI_STRERROR_PROTO, 1,
1257                 [Define if gai_strerror() returns const char *])])])
1258
1259 AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP, 1,
1260         [Some systems put nanosleep outside of libc]))
1261
1262 dnl Make sure prototypes are defined for these before using them.
1263 AC_CHECK_DECL(getrusage, [AC_CHECK_FUNCS(getrusage)])
1264 AC_CHECK_DECL(strsep,
1265         [AC_CHECK_FUNCS(strsep)],
1266         [],
1267         [
1268 #ifdef HAVE_STRING_H
1269 # include <string.h>
1270 #endif
1271         ])
1272
1273 dnl tcsendbreak might be a macro
1274 AC_CHECK_DECL(tcsendbreak,
1275         [AC_DEFINE(HAVE_TCSENDBREAK)],
1276         [AC_CHECK_FUNCS(tcsendbreak)],
1277         [#include <termios.h>]
1278 )
1279
1280 AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>])
1281
1282 AC_CHECK_FUNCS(setresuid, [
1283         dnl Some platorms have setresuid that isn't implemented, test for this
1284         AC_MSG_CHECKING(if setresuid seems to work)
1285         AC_RUN_IFELSE(
1286                 [AC_LANG_SOURCE([[
1287 #include <stdlib.h>
1288 #include <errno.h>
1289 int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1290                 ]])],
1291                 [AC_MSG_RESULT(yes)],
1292                 [AC_DEFINE(BROKEN_SETRESUID, 1,
1293                         [Define if your setresuid() is broken])
1294                  AC_MSG_RESULT(not implemented)],
1295                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1296         )
1297 ])
1298
1299 AC_CHECK_FUNCS(setresgid, [
1300         dnl Some platorms have setresgid that isn't implemented, test for this
1301         AC_MSG_CHECKING(if setresgid seems to work)
1302         AC_RUN_IFELSE(
1303                 [AC_LANG_SOURCE([[
1304 #include <stdlib.h>
1305 #include <errno.h>
1306 int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1307                 ]])],
1308                 [AC_MSG_RESULT(yes)],
1309                 [AC_DEFINE(BROKEN_SETRESGID, 1,
1310                         [Define if your setresgid() is broken])
1311                  AC_MSG_RESULT(not implemented)],
1312                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1313         )
1314 ])
1315
1316 dnl    Checks for time functions
1317 AC_CHECK_FUNCS(gettimeofday time)
1318 dnl    Checks for utmp functions
1319 AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent)
1320 AC_CHECK_FUNCS(utmpname)
1321 dnl    Checks for utmpx functions
1322 AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
1323 AC_CHECK_FUNCS(setutxent utmpxname)
1324
1325 AC_CHECK_FUNC(daemon,
1326         [AC_DEFINE(HAVE_DAEMON, 1, [Define if your libraries define daemon()])],
1327         [AC_CHECK_LIB(bsd, daemon,
1328                 [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
1329 )
1330
1331 AC_CHECK_FUNC(getpagesize,
1332         [AC_DEFINE(HAVE_GETPAGESIZE, 1,
1333                 [Define if your libraries define getpagesize()])],
1334         [AC_CHECK_LIB(ucb, getpagesize,
1335                 [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
1336 )
1337
1338 # Check for broken snprintf
1339 if test "x$ac_cv_func_snprintf" = "xyes" ; then
1340         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
1341         AC_RUN_IFELSE(
1342                 [AC_LANG_SOURCE([[
1343 #include <stdio.h>
1344 int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
1345                 ]])],
1346                 [AC_MSG_RESULT(yes)],
1347                 [
1348                         AC_MSG_RESULT(no)
1349                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1350                                 [Define if your snprintf is busted])
1351                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
1352                 ],
1353                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
1354         )
1355 fi
1356
1357 # If we don't have a working asprintf, then we strongly depend on vsnprintf
1358 # returning the right thing on overflow: the number of characters it tried to
1359 # create (as per SUSv3)
1360 if test "x$ac_cv_func_asprintf" != "xyes" && \
1361    test "x$ac_cv_func_vsnprintf" = "xyes" ; then
1362         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
1363         AC_RUN_IFELSE(
1364                 [AC_LANG_SOURCE([[
1365 #include <sys/types.h>
1366 #include <stdio.h>
1367 #include <stdarg.h>
1368
1369 int x_snprintf(char *str,size_t count,const char *fmt,...)
1370 {
1371         size_t ret; va_list ap;
1372         va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
1373         return ret;
1374 }
1375 int main(void)
1376 {
1377         char x[1];
1378         exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
1379 } ]])],
1380                 [AC_MSG_RESULT(yes)],
1381                 [
1382                         AC_MSG_RESULT(no)
1383                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1384                                 [Define if your snprintf is busted])
1385                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
1386                 ],
1387                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
1388         )
1389 fi
1390
1391 # On systems where [v]snprintf is broken, but is declared in stdio,
1392 # check that the fmt argument is const char * or just char *.
1393 # This is only useful for when BROKEN_SNPRINTF
1394 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
1395 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#include <stdio.h>
1396            int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
1397            int main(void) { snprintf(0, 0, 0); }
1398     ]])],
1399    [AC_MSG_RESULT(yes)
1400     AC_DEFINE(SNPRINTF_CONST, [const],
1401               [Define as const if snprintf() can declare const char *fmt])],
1402    [AC_MSG_RESULT(no)
1403     AC_DEFINE(SNPRINTF_CONST, [/* not const */])])
1404
1405 # Check for missing getpeereid (or equiv) support
1406 NO_PEERCHECK=""
1407 if test "x$ac_cv_func_getpeereid" != "xyes" ; then
1408         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
1409         AC_TRY_COMPILE(
1410                 [#include <sys/types.h>
1411                  #include <sys/socket.h>],
1412                 [int i = SO_PEERCRED;],
1413                 [ AC_MSG_RESULT(yes)
1414                   AC_DEFINE(HAVE_SO_PEERCRED, 1, [Have PEERCRED socket option])
1415                 ],
1416                 [AC_MSG_RESULT(no)
1417                 NO_PEERCHECK=1]
1418         )
1419 fi
1420
1421 dnl see whether mkstemp() requires XXXXXX
1422 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
1423 AC_MSG_CHECKING([for (overly) strict mkstemp])
1424 AC_RUN_IFELSE(
1425         [AC_LANG_SOURCE([[
1426 #include <stdlib.h>
1427 main() { char template[]="conftest.mkstemp-test";
1428 if (mkstemp(template) == -1)
1429         exit(1);
1430 unlink(template); exit(0);
1431 }
1432         ]])],
1433         [
1434                 AC_MSG_RESULT(no)
1435         ],
1436         [
1437                 AC_MSG_RESULT(yes)
1438                 AC_DEFINE(HAVE_STRICT_MKSTEMP, 1, [Silly mkstemp()])
1439         ],
1440         [
1441                 AC_MSG_RESULT(yes)
1442                 AC_DEFINE(HAVE_STRICT_MKSTEMP)
1443         ]
1444 )
1445 fi
1446
1447 dnl make sure that openpty does not reacquire controlling terminal
1448 if test ! -z "$check_for_openpty_ctty_bug"; then
1449         AC_MSG_CHECKING(if openpty correctly handles controlling tty)
1450         AC_RUN_IFELSE(
1451                 [AC_LANG_SOURCE([[
1452 #include <stdio.h>
1453 #include <sys/fcntl.h>
1454 #include <sys/types.h>
1455 #include <sys/wait.h>
1456
1457 int
1458 main()
1459 {
1460         pid_t pid;
1461         int fd, ptyfd, ttyfd, status;
1462
1463         pid = fork();
1464         if (pid < 0) {          /* failed */
1465                 exit(1);
1466         } else if (pid > 0) {   /* parent */
1467                 waitpid(pid, &status, 0);
1468                 if (WIFEXITED(status))
1469                         exit(WEXITSTATUS(status));
1470                 else
1471                         exit(2);
1472         } else {                /* child */
1473                 close(0); close(1); close(2);
1474                 setsid();
1475                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
1476                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
1477                 if (fd >= 0)
1478                         exit(3);        /* Acquired ctty: broken */
1479                 else
1480                         exit(0);        /* Did not acquire ctty: OK */
1481         }
1482 }
1483                 ]])],
1484                 [
1485                         AC_MSG_RESULT(yes)
1486                 ],
1487                 [
1488                         AC_MSG_RESULT(no)
1489                         AC_DEFINE(SSHD_ACQUIRES_CTTY)
1490                 ],
1491                 [
1492                         AC_MSG_RESULT(cross-compiling, assuming yes)
1493                 ]
1494         )
1495 fi
1496
1497 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1498     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
1499         AC_MSG_CHECKING(if getaddrinfo seems to work)
1500         AC_RUN_IFELSE(
1501                 [AC_LANG_SOURCE([[
1502 #include <stdio.h>
1503 #include <sys/socket.h>
1504 #include <netdb.h>
1505 #include <errno.h>
1506 #include <netinet/in.h>
1507
1508 #define TEST_PORT "2222"
1509
1510 int
1511 main(void)
1512 {
1513         int err, sock;
1514         struct addrinfo *gai_ai, *ai, hints;
1515         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1516
1517         memset(&hints, 0, sizeof(hints));
1518         hints.ai_family = PF_UNSPEC;
1519         hints.ai_socktype = SOCK_STREAM;
1520         hints.ai_flags = AI_PASSIVE;
1521
1522         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1523         if (err != 0) {
1524                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1525                 exit(1);
1526         }
1527
1528         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1529                 if (ai->ai_family != AF_INET6)
1530                         continue;
1531
1532                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1533                     sizeof(ntop), strport, sizeof(strport),
1534                     NI_NUMERICHOST|NI_NUMERICSERV);
1535
1536                 if (err != 0) {
1537                         if (err == EAI_SYSTEM)
1538                                 perror("getnameinfo EAI_SYSTEM");
1539                         else
1540                                 fprintf(stderr, "getnameinfo failed: %s\n",
1541                                     gai_strerror(err));
1542                         exit(2);
1543                 }
1544
1545                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
1546                 if (sock < 0)
1547                         perror("socket");
1548                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1549                         if (errno == EBADF)
1550                                 exit(3);
1551                 }
1552         }
1553         exit(0);
1554 }
1555                 ]])],
1556                 [
1557                         AC_MSG_RESULT(yes)
1558                 ],
1559                 [
1560                         AC_MSG_RESULT(no)
1561                         AC_DEFINE(BROKEN_GETADDRINFO)
1562                 ],
1563                 [
1564                         AC_MSG_RESULT(cross-compiling, assuming yes)
1565                 ]
1566         )
1567 fi
1568
1569 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1570     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
1571         AC_MSG_CHECKING(if getaddrinfo seems to work)
1572         AC_RUN_IFELSE(
1573                 [AC_LANG_SOURCE([[
1574 #include <stdio.h>
1575 #include <sys/socket.h>
1576 #include <netdb.h>
1577 #include <errno.h>
1578 #include <netinet/in.h>
1579
1580 #define TEST_PORT "2222"
1581
1582 int
1583 main(void)
1584 {
1585         int err, sock;
1586         struct addrinfo *gai_ai, *ai, hints;
1587         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1588
1589         memset(&hints, 0, sizeof(hints));
1590         hints.ai_family = PF_UNSPEC;
1591         hints.ai_socktype = SOCK_STREAM;
1592         hints.ai_flags = AI_PASSIVE;
1593
1594         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1595         if (err != 0) {
1596                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1597                 exit(1);
1598         }
1599
1600         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1601                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1602                         continue;
1603
1604                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1605                     sizeof(ntop), strport, sizeof(strport),
1606                     NI_NUMERICHOST|NI_NUMERICSERV);
1607
1608                 if (ai->ai_family == AF_INET && err != 0) {
1609                         perror("getnameinfo");
1610                         exit(2);
1611                 }
1612         }
1613         exit(0);
1614 }
1615                 ]])],
1616                 [
1617                         AC_MSG_RESULT(yes)
1618                         AC_DEFINE(AIX_GETNAMEINFO_HACK, 1,
1619                                 [Define if you have a getaddrinfo that fails
1620                                 for the all-zeros IPv6 address])
1621                 ],
1622                 [
1623                         AC_MSG_RESULT(no)
1624                         AC_DEFINE(BROKEN_GETADDRINFO)
1625                 ],
1626                 [
1627                         AC_MSG_RESULT(cross-compiling, assuming no)
1628                 ]
1629         )
1630 fi
1631
1632 if test "x$check_for_conflicting_getspnam" = "x1"; then
1633         AC_MSG_CHECKING(for conflicting getspnam in shadow.h)
1634         AC_COMPILE_IFELSE(
1635                 [
1636 #include <shadow.h>
1637 int main(void) {exit(0);}
1638                 ],
1639                 [
1640                         AC_MSG_RESULT(no)
1641                 ],
1642                 [
1643                         AC_MSG_RESULT(yes)
1644                         AC_DEFINE(GETSPNAM_CONFLICTING_DEFS, 1,
1645                             [Conflicting defs for getspnam])
1646                 ]
1647         )
1648 fi
1649
1650 AC_FUNC_GETPGRP
1651
1652 # Check for PAM libs
1653 PAM_MSG="no"
1654 AC_ARG_WITH(pam,
1655         [  --with-pam              Enable PAM support ],
1656         [
1657                 if test "x$withval" != "xno" ; then
1658                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
1659                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
1660                                 AC_MSG_ERROR([PAM headers not found])
1661                         fi
1662
1663                         AC_CHECK_LIB(dl, dlopen, , )
1664                         AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
1665                         AC_CHECK_FUNCS(pam_getenvlist)
1666                         AC_CHECK_FUNCS(pam_putenv)
1667
1668                         PAM_MSG="yes"
1669
1670                         AC_DEFINE(USE_PAM, 1,
1671                                 [Define if you want to enable PAM support])
1672                         if test $ac_cv_lib_dl_dlopen = yes; then
1673                                 LIBPAM="-lpam -ldl"
1674                         else
1675                                 LIBPAM="-lpam"
1676                         fi
1677                         AC_SUBST(LIBPAM)
1678                 fi
1679         ]
1680 )
1681
1682 # Check for older PAM
1683 if test "x$PAM_MSG" = "xyes" ; then
1684         # Check PAM strerror arguments (old PAM)
1685         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
1686         AC_TRY_COMPILE(
1687                 [
1688 #include <stdlib.h>
1689 #if defined(HAVE_SECURITY_PAM_APPL_H)
1690 #include <security/pam_appl.h>
1691 #elif defined (HAVE_PAM_PAM_APPL_H)
1692 #include <pam/pam_appl.h>
1693 #endif
1694                 ],
1695                 [(void)pam_strerror((pam_handle_t *)NULL, -1);],
1696                 [AC_MSG_RESULT(no)],
1697                 [
1698                         AC_DEFINE(HAVE_OLD_PAM, 1,
1699                                 [Define if you have an old version of PAM
1700                                 which takes only one argument to pam_strerror])
1701                         AC_MSG_RESULT(yes)
1702                         PAM_MSG="yes (old library)"
1703                 ]
1704         )
1705 fi
1706
1707 # Search for OpenSSL
1708 saved_CPPFLAGS="$CPPFLAGS"
1709 saved_LDFLAGS="$LDFLAGS"
1710 AC_ARG_WITH(ssl-dir,
1711         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
1712         [
1713                 if test "x$withval" != "xno" ; then
1714                         case "$withval" in
1715                                 # Relative paths
1716                                 ./*|../*)       withval="`pwd`/$withval"
1717                         esac
1718                         if test -d "$withval/lib"; then
1719                                 if test -n "${need_dash_r}"; then
1720                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1721                                 else
1722                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1723                                 fi
1724                         else
1725                                 if test -n "${need_dash_r}"; then
1726                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1727                                 else
1728                                         LDFLAGS="-L${withval} ${LDFLAGS}"
1729                                 fi
1730                         fi
1731                         if test -d "$withval/include"; then
1732                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1733                         else
1734                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
1735                         fi
1736                 fi
1737         ]
1738 )
1739 LIBS="-lcrypto $LIBS"
1740 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL, 1,
1741         [Define if your ssl headers are included
1742         with #include <openssl/header.h>]),
1743         [
1744                 dnl Check default openssl install dir
1745                 if test -n "${need_dash_r}"; then
1746                         LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
1747                 else
1748                         LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
1749                 fi
1750                 CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
1751                 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
1752                         [
1753                                 AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
1754                         ]
1755                 )
1756         ]
1757 )
1758
1759 # Determine OpenSSL header version
1760 AC_MSG_CHECKING([OpenSSL header version])
1761 AC_RUN_IFELSE(
1762         [AC_LANG_SOURCE([[
1763 #include <stdio.h>
1764 #include <string.h>
1765 #include <openssl/opensslv.h>
1766 #define DATA "conftest.sslincver"
1767 int main(void) {
1768         FILE *fd;
1769         int rc;
1770
1771         fd = fopen(DATA,"w");
1772         if(fd == NULL)
1773                 exit(1);
1774
1775         if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
1776                 exit(1);
1777
1778         exit(0);
1779 }
1780         ]])],
1781         [
1782                 ssl_header_ver=`cat conftest.sslincver`
1783                 AC_MSG_RESULT($ssl_header_ver)
1784         ],
1785         [
1786                 AC_MSG_RESULT(not found)
1787                 AC_MSG_ERROR(OpenSSL version header not found.)
1788         ],
1789         [
1790                 AC_MSG_WARN([cross compiling: not checking])
1791         ]
1792 )
1793
1794 # Determine OpenSSL library version
1795 AC_MSG_CHECKING([OpenSSL library version])
1796 AC_RUN_IFELSE(
1797         [AC_LANG_SOURCE([[
1798 #include <stdio.h>
1799 #include <string.h>
1800 #include <openssl/opensslv.h>
1801 #include <openssl/crypto.h>
1802 #define DATA "conftest.ssllibver"
1803 int main(void) {
1804         FILE *fd;
1805         int rc;
1806
1807         fd = fopen(DATA,"w");
1808         if(fd == NULL)
1809                 exit(1);
1810
1811         if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
1812                 exit(1);
1813
1814         exit(0);
1815 }
1816         ]])],
1817         [
1818                 ssl_library_ver=`cat conftest.ssllibver`
1819                 AC_MSG_RESULT($ssl_library_ver)
1820         ],
1821         [
1822                 AC_MSG_RESULT(not found)
1823                 AC_MSG_ERROR(OpenSSL library not found.)
1824         ],
1825         [
1826                 AC_MSG_WARN([cross compiling: not checking])
1827         ]
1828 )
1829
1830 # Sanity check OpenSSL headers
1831 AC_MSG_CHECKING([whether OpenSSL's headers match the library])
1832 AC_RUN_IFELSE(
1833         [AC_LANG_SOURCE([[
1834 #include <string.h>
1835 #include <openssl/opensslv.h>
1836 int main(void) { exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
1837         ]])],
1838         [
1839                 AC_MSG_RESULT(yes)
1840         ],
1841         [
1842                 AC_MSG_RESULT(no)
1843                 AC_MSG_ERROR([Your OpenSSL headers do not match your library.
1844 Check config.log for details.
1845 Also see contrib/findssl.sh for help identifying header/library mismatches.])
1846         ],
1847         [
1848                 AC_MSG_WARN([cross compiling: not checking])
1849         ]
1850 )
1851
1852 AC_ARG_WITH(ssl-engine,
1853         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
1854         [ if test "x$withval" != "xno" ; then
1855                 AC_MSG_CHECKING(for OpenSSL ENGINE support)
1856                 AC_TRY_COMPILE(
1857                         [ #include <openssl/engine.h>],
1858                         [
1859 int main(void){ENGINE_load_builtin_engines();ENGINE_register_all_complete();}
1860                         ],
1861                         [ AC_MSG_RESULT(yes)
1862                           AC_DEFINE(USE_OPENSSL_ENGINE, 1,
1863                              [Enable OpenSSL engine support])
1864                         ],
1865                         [ AC_MSG_ERROR(OpenSSL ENGINE support not found)]
1866                 )
1867           fi ]
1868 )
1869
1870 # Check for OpenSSL without EVP_aes_{192,256}_cbc
1871 AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
1872 AC_COMPILE_IFELSE(
1873         [AC_LANG_SOURCE([[
1874 #include <string.h>
1875 #include <openssl/evp.h>
1876 int main(void) { exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);}
1877         ]])],
1878         [
1879                 AC_MSG_RESULT(no)
1880         ],
1881         [
1882                 AC_MSG_RESULT(yes)
1883                 AC_DEFINE(OPENSSL_LOBOTOMISED_AES, 1,
1884                     [libcrypto is missing AES 192 and 256 bit functions])
1885         ]
1886 )
1887
1888 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
1889 # because the system crypt() is more featureful.
1890 if test "x$check_for_libcrypt_before" = "x1"; then
1891         AC_CHECK_LIB(crypt, crypt)
1892 fi
1893
1894 # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
1895 # version in OpenSSL.
1896 if test "x$check_for_libcrypt_later" = "x1"; then
1897         AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
1898 fi
1899
1900 # Search for SHA256 support in libc and/or OpenSSL
1901 AC_CHECK_FUNCS(SHA256_Update EVP_sha256)
1902
1903 AC_CHECK_LIB(iaf, ia_openinfo)
1904
1905 ### Configure cryptographic random number support
1906
1907 # Check wheter OpenSSL seeds itself
1908 AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
1909 AC_RUN_IFELSE(
1910         [AC_LANG_SOURCE([[
1911 #include <string.h>
1912 #include <openssl/rand.h>
1913 int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
1914         ]])],
1915         [
1916                 OPENSSL_SEEDS_ITSELF=yes
1917                 AC_MSG_RESULT(yes)
1918         ],
1919         [
1920                 AC_MSG_RESULT(no)
1921                 # Default to use of the rand helper if OpenSSL doesn't
1922                 # seed itself
1923                 USE_RAND_HELPER=yes
1924         ],
1925         [
1926                 AC_MSG_WARN([cross compiling: assuming yes])
1927                 # This is safe, since all recent OpenSSL versions will
1928                 # complain at runtime if not seeded correctly.
1929                 OPENSSL_SEEDS_ITSELF=yes
1930         ]
1931 )
1932
1933
1934 # Do we want to force the use of the rand helper?
1935 AC_ARG_WITH(rand-helper,
1936         [  --with-rand-helper      Use subprocess to gather strong randomness ],
1937         [
1938                 if test "x$withval" = "xno" ; then
1939                         # Force use of OpenSSL's internal RNG, even if
1940                         # the previous test showed it to be unseeded.
1941                         if test -z "$OPENSSL_SEEDS_ITSELF" ; then
1942                                 AC_MSG_WARN([*** Forcing use of OpenSSL's non-self-seeding PRNG])
1943                                 OPENSSL_SEEDS_ITSELF=yes
1944                                 USE_RAND_HELPER=""
1945                         fi
1946                 else
1947                         USE_RAND_HELPER=yes
1948                 fi
1949         ],
1950 )
1951
1952 # Which randomness source do we use?
1953 if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
1954         # OpenSSL only
1955         AC_DEFINE(OPENSSL_PRNG_ONLY, 1,
1956                 [Define if you want OpenSSL's internally seeded PRNG only])
1957         RAND_MSG="OpenSSL internal ONLY"
1958         INSTALL_SSH_RAND_HELPER=""
1959 elif test ! -z "$USE_RAND_HELPER" ; then
1960         # install rand helper
1961         RAND_MSG="ssh-rand-helper"
1962         INSTALL_SSH_RAND_HELPER="yes"
1963 fi
1964 AC_SUBST(INSTALL_SSH_RAND_HELPER)
1965
1966 ### Configuration of ssh-rand-helper
1967
1968 # PRNGD TCP socket
1969 AC_ARG_WITH(prngd-port,
1970         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
1971         [
1972                 case "$withval" in
1973                 no)
1974                         withval=""
1975                         ;;
1976                 [[0-9]]*)
1977                         ;;
1978                 *)
1979                         AC_MSG_ERROR(You must specify a numeric port number for --with-prngd-port)
1980                         ;;
1981                 esac
1982                 if test ! -z "$withval" ; then
1983                         PRNGD_PORT="$withval"
1984                         AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT,
1985                                 [Port number of PRNGD/EGD random number socket])
1986                 fi
1987         ]
1988 )
1989
1990 # PRNGD Unix domain socket
1991 AC_ARG_WITH(prngd-socket,
1992         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
1993         [
1994                 case "$withval" in
1995                 yes)
1996                         withval="/var/run/egd-pool"
1997                         ;;
1998                 no)
1999                         withval=""
2000                         ;;
2001                 /*)
2002                         ;;
2003                 *)
2004                         AC_MSG_ERROR(You must specify an absolute path to the entropy socket)
2005                         ;;
2006                 esac
2007
2008                 if test ! -z "$withval" ; then
2009                         if test ! -z "$PRNGD_PORT" ; then
2010                                 AC_MSG_ERROR(You may not specify both a PRNGD/EGD port and socket)
2011                         fi
2012                         if test ! -r "$withval" ; then
2013                                 AC_MSG_WARN(Entropy socket is not readable)
2014                         fi
2015                         PRNGD_SOCKET="$withval"
2016                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET",
2017                                 [Location of PRNGD/EGD random number socket])
2018                 fi
2019         ],
2020         [
2021                 # Check for existing socket only if we don't have a random device already
2022                 if test "$USE_RAND_HELPER" = yes ; then
2023                         AC_MSG_CHECKING(for PRNGD/EGD socket)
2024                         # Insert other locations here
2025                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
2026                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
2027                                         PRNGD_SOCKET="$sock"
2028                                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
2029                                         break;
2030                                 fi
2031                         done
2032                         if test ! -z "$PRNGD_SOCKET" ; then
2033                                 AC_MSG_RESULT($PRNGD_SOCKET)
2034                         else
2035                                 AC_MSG_RESULT(not found)
2036                         fi
2037                 fi
2038         ]
2039 )
2040
2041 # Change default command timeout for hashing entropy source
2042 entropy_timeout=200
2043 AC_ARG_WITH(entropy-timeout,
2044         [  --with-entropy-timeout  Specify entropy gathering command timeout (msec)],
2045         [
2046                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2047                     test "x${withval}" != "xyes"; then
2048                         entropy_timeout=$withval
2049                 fi
2050         ]
2051 )
2052 AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout,
2053         [Builtin PRNG command timeout])
2054
2055 SSH_PRIVSEP_USER=sshd
2056 AC_ARG_WITH(privsep-user,
2057         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
2058         [
2059                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2060                     test "x${withval}" != "xyes"; then
2061                         SSH_PRIVSEP_USER=$withval
2062                 fi
2063         ]
2064 )
2065 AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER",
2066         [non-privileged user for privilege separation])
2067 AC_SUBST(SSH_PRIVSEP_USER)
2068
2069 # We do this little dance with the search path to insure
2070 # that programs that we select for use by installed programs
2071 # (which may be run by the super-user) come from trusted
2072 # locations before they come from the user's private area.
2073 # This should help avoid accidentally configuring some
2074 # random version of a program in someone's personal bin.
2075
2076 OPATH=$PATH
2077 PATH=/bin:/usr/bin
2078 test -h /bin 2> /dev/null && PATH=/usr/bin
2079 test -d /sbin && PATH=$PATH:/sbin
2080 test -d /usr/sbin && PATH=$PATH:/usr/sbin
2081 PATH=$PATH:/etc:$OPATH
2082
2083 # These programs are used by the command hashing source to gather entropy
2084 OSSH_PATH_ENTROPY_PROG(PROG_LS, ls)
2085 OSSH_PATH_ENTROPY_PROG(PROG_NETSTAT, netstat)
2086 OSSH_PATH_ENTROPY_PROG(PROG_ARP, arp)
2087 OSSH_PATH_ENTROPY_PROG(PROG_IFCONFIG, ifconfig)
2088 OSSH_PATH_ENTROPY_PROG(PROG_JSTAT, jstat)
2089 OSSH_PATH_ENTROPY_PROG(PROG_PS, ps)
2090 OSSH_PATH_ENTROPY_PROG(PROG_SAR, sar)
2091 OSSH_PATH_ENTROPY_PROG(PROG_W, w)
2092 OSSH_PATH_ENTROPY_PROG(PROG_WHO, who)
2093 OSSH_PATH_ENTROPY_PROG(PROG_LAST, last)
2094 OSSH_PATH_ENTROPY_PROG(PROG_LASTLOG, lastlog)
2095 OSSH_PATH_ENTROPY_PROG(PROG_DF, df)
2096 OSSH_PATH_ENTROPY_PROG(PROG_VMSTAT, vmstat)
2097 OSSH_PATH_ENTROPY_PROG(PROG_UPTIME, uptime)
2098 OSSH_PATH_ENTROPY_PROG(PROG_IPCS, ipcs)
2099 OSSH_PATH_ENTROPY_PROG(PROG_TAIL, tail)
2100 # restore PATH
2101 PATH=$OPATH
2102
2103 # Where does ssh-rand-helper get its randomness from?
2104 INSTALL_SSH_PRNG_CMDS=""
2105 if test ! -z "$INSTALL_SSH_RAND_HELPER" ; then
2106         if test ! -z "$PRNGD_PORT" ; then
2107                 RAND_HELPER_MSG="TCP localhost:$PRNGD_PORT"
2108         elif test ! -z "$PRNGD_SOCKET" ; then
2109                 RAND_HELPER_MSG="Unix domain socket \"$PRNGD_SOCKET\""
2110         else
2111                 RAND_HELPER_MSG="Command hashing (timeout $entropy_timeout)"
2112                 RAND_HELPER_CMDHASH=yes
2113                 INSTALL_SSH_PRNG_CMDS="yes"
2114         fi
2115 fi
2116 AC_SUBST(INSTALL_SSH_PRNG_CMDS)
2117
2118
2119 # Cheap hack to ensure NEWS-OS libraries are arranged right.
2120 if test ! -z "$SONY" ; then
2121   LIBS="$LIBS -liberty";
2122 fi
2123
2124 # Check for  long long datatypes
2125 AC_CHECK_TYPES([long long, unsigned long long, long double])
2126
2127 # Check datatype sizes
2128 AC_CHECK_SIZEOF(char, 1)
2129 AC_CHECK_SIZEOF(short int, 2)
2130 AC_CHECK_SIZEOF(int, 4)
2131 AC_CHECK_SIZEOF(long int, 4)
2132 AC_CHECK_SIZEOF(long long int, 8)
2133
2134 # Sanity check long long for some platforms (AIX)
2135 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
2136         ac_cv_sizeof_long_long_int=0
2137 fi
2138
2139 # compute LLONG_MIN and LLONG_MAX if we don't know them.
2140 if test -z "$have_llong_max"; then
2141         AC_MSG_CHECKING([for max value of long long])
2142         AC_RUN_IFELSE(
2143                 [AC_LANG_SOURCE([[
2144 #include <stdio.h>
2145 /* Why is this so damn hard? */
2146 #ifdef __GNUC__
2147 # undef __GNUC__
2148 #endif
2149 #define __USE_ISOC99
2150 #include <limits.h>
2151 #define DATA "conftest.llminmax"
2152 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
2153
2154 /*
2155  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
2156  * we do this the hard way.
2157  */
2158 static int
2159 fprint_ll(FILE *f, long long n)
2160 {
2161         unsigned int i;
2162         int l[sizeof(long long) * 8];
2163
2164         if (n < 0)
2165                 if (fprintf(f, "-") < 0)
2166                         return -1;
2167         for (i = 0; n != 0; i++) {
2168                 l[i] = my_abs(n % 10);
2169                 n /= 10;
2170         }
2171         do {
2172                 if (fprintf(f, "%d", l[--i]) < 0)
2173                         return -1;
2174         } while (i != 0);
2175         if (fprintf(f, " ") < 0)
2176                 return -1;
2177         return 0;
2178 }
2179
2180 int main(void) {
2181         FILE *f;
2182         long long i, llmin, llmax = 0;
2183
2184         if((f = fopen(DATA,"w")) == NULL)
2185                 exit(1);
2186
2187 #if defined(LLONG_MIN) && defined(LLONG_MAX)
2188         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
2189         llmin = LLONG_MIN;
2190         llmax = LLONG_MAX;
2191 #else
2192         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
2193         /* This will work on one's complement and two's complement */
2194         for (i = 1; i > llmax; i <<= 1, i++)
2195                 llmax = i;
2196         llmin = llmax + 1LL;    /* wrap */
2197 #endif
2198
2199         /* Sanity check */
2200         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
2201             || llmax - 1 > llmax || llmin == llmax || llmin == 0
2202             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
2203                 fprintf(f, "unknown unknown\n");
2204                 exit(2);
2205         }
2206
2207         if (fprint_ll(f, llmin) < 0)
2208                 exit(3);
2209         if (fprint_ll(f, llmax) < 0)
2210                 exit(4);
2211         if (fclose(f) < 0)
2212                 exit(5);
2213         exit(0);
2214 }
2215                 ]])],
2216                 [
2217                         llong_min=`$AWK '{print $1}' conftest.llminmax`
2218                         llong_max=`$AWK '{print $2}' conftest.llminmax`
2219
2220                         AC_MSG_RESULT($llong_max)
2221                         AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
2222                             [max value of long long calculated by configure])
2223                         AC_MSG_CHECKING([for min value of long long])
2224                         AC_MSG_RESULT($llong_min)
2225                         AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
2226                             [min value of long long calculated by configure])
2227                 ],
2228                 [
2229                         AC_MSG_RESULT(not found)
2230                 ],
2231                 [
2232                         AC_MSG_WARN([cross compiling: not checking])
2233                 ]
2234         )
2235 fi
2236
2237
2238 # More checks for data types
2239 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
2240         AC_TRY_COMPILE(
2241                 [ #include <sys/types.h> ],
2242                 [ u_int a; a = 1;],
2243                 [ ac_cv_have_u_int="yes" ],
2244                 [ ac_cv_have_u_int="no" ]
2245         )
2246 ])
2247 if test "x$ac_cv_have_u_int" = "xyes" ; then
2248         AC_DEFINE(HAVE_U_INT, 1, [define if you have u_int data type])
2249         have_u_int=1
2250 fi
2251
2252 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
2253         AC_TRY_COMPILE(
2254                 [ #include <sys/types.h> ],
2255                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2256                 [ ac_cv_have_intxx_t="yes" ],
2257                 [ ac_cv_have_intxx_t="no" ]
2258         )
2259 ])
2260 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
2261         AC_DEFINE(HAVE_INTXX_T, 1, [define if you have intxx_t data type])
2262         have_intxx_t=1
2263 fi
2264
2265 if (test -z "$have_intxx_t" && \
2266            test "x$ac_cv_header_stdint_h" = "xyes")
2267 then
2268     AC_MSG_CHECKING([for intXX_t types in stdint.h])
2269         AC_TRY_COMPILE(
2270                 [ #include <stdint.h> ],
2271                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2272                 [
2273                         AC_DEFINE(HAVE_INTXX_T)
2274                         AC_MSG_RESULT(yes)
2275                 ],
2276                 [ AC_MSG_RESULT(no) ]
2277         )
2278 fi
2279
2280 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
2281         AC_TRY_COMPILE(
2282                 [
2283 #include <sys/types.h>
2284 #ifdef HAVE_STDINT_H
2285 # include <stdint.h>
2286 #endif
2287 #include <sys/socket.h>
2288 #ifdef HAVE_SYS_BITYPES_H
2289 # include <sys/bitypes.h>
2290 #endif
2291                 ],
2292                 [ int64_t a; a = 1;],
2293                 [ ac_cv_have_int64_t="yes" ],
2294                 [ ac_cv_have_int64_t="no" ]
2295         )
2296 ])
2297 if test "x$ac_cv_have_int64_t" = "xyes" ; then
2298         AC_DEFINE(HAVE_INT64_T, 1, [define if you have int64_t data type])
2299 fi
2300
2301 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
2302         AC_TRY_COMPILE(
2303                 [ #include <sys/types.h> ],
2304                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2305                 [ ac_cv_have_u_intxx_t="yes" ],
2306                 [ ac_cv_have_u_intxx_t="no" ]
2307         )
2308 ])
2309 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
2310         AC_DEFINE(HAVE_U_INTXX_T, 1, [define if you have u_intxx_t data type])
2311         have_u_intxx_t=1
2312 fi
2313
2314 if test -z "$have_u_intxx_t" ; then
2315     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
2316         AC_TRY_COMPILE(
2317                 [ #include <sys/socket.h> ],
2318                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2319                 [
2320                         AC_DEFINE(HAVE_U_INTXX_T)
2321                         AC_MSG_RESULT(yes)
2322                 ],
2323                 [ AC_MSG_RESULT(no) ]
2324         )
2325 fi
2326
2327 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
2328         AC_TRY_COMPILE(
2329                 [ #include <sys/types.h> ],
2330                 [ u_int64_t a; a = 1;],
2331                 [ ac_cv_have_u_int64_t="yes" ],
2332                 [ ac_cv_have_u_int64_t="no" ]
2333         )
2334 ])
2335 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
2336         AC_DEFINE(HAVE_U_INT64_T, 1, [define if you have u_int64_t data type])
2337         have_u_int64_t=1
2338 fi
2339
2340 if test -z "$have_u_int64_t" ; then
2341     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
2342         AC_TRY_COMPILE(
2343                 [ #include <sys/bitypes.h> ],
2344                 [ u_int64_t a; a = 1],
2345                 [
2346                         AC_DEFINE(HAVE_U_INT64_T)
2347                         AC_MSG_RESULT(yes)
2348                 ],
2349                 [ AC_MSG_RESULT(no) ]
2350         )
2351 fi
2352
2353 if test -z "$have_u_intxx_t" ; then
2354         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
2355                 AC_TRY_COMPILE(
2356                         [
2357 #include <sys/types.h>
2358                         ],
2359                         [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1; ],
2360                         [ ac_cv_have_uintxx_t="yes" ],
2361                         [ ac_cv_have_uintxx_t="no" ]
2362                 )
2363         ])
2364         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
2365                 AC_DEFINE(HAVE_UINTXX_T, 1,
2366                         [define if you have uintxx_t data type])
2367         fi
2368 fi
2369
2370 if test -z "$have_uintxx_t" ; then
2371     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
2372         AC_TRY_COMPILE(
2373                 [ #include <stdint.h> ],
2374                 [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;],
2375                 [
2376                         AC_DEFINE(HAVE_UINTXX_T)
2377                         AC_MSG_RESULT(yes)
2378                 ],
2379                 [ AC_MSG_RESULT(no) ]
2380         )
2381 fi
2382
2383 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
2384            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
2385 then
2386         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
2387         AC_TRY_COMPILE(
2388                 [
2389 #include <sys/bitypes.h>
2390                 ],
2391                 [
2392                         int8_t a; int16_t b; int32_t c;
2393                         u_int8_t e; u_int16_t f; u_int32_t g;
2394                         a = b = c = e = f = g = 1;
2395                 ],
2396                 [
2397                         AC_DEFINE(HAVE_U_INTXX_T)
2398                         AC_DEFINE(HAVE_INTXX_T)
2399                         AC_MSG_RESULT(yes)
2400                 ],
2401                 [AC_MSG_RESULT(no)]
2402         )
2403 fi
2404
2405
2406 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
2407         AC_TRY_COMPILE(
2408                 [
2409 #include <sys/types.h>
2410                 ],
2411                 [ u_char foo; foo = 125; ],
2412                 [ ac_cv_have_u_char="yes" ],
2413                 [ ac_cv_have_u_char="no" ]
2414         )
2415 ])
2416 if test "x$ac_cv_have_u_char" = "xyes" ; then
2417         AC_DEFINE(HAVE_U_CHAR, 1, [define if you have u_char data type])
2418 fi
2419
2420 TYPE_SOCKLEN_T
2421
2422 AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
2423
2424 AC_CHECK_TYPES(in_addr_t,,,
2425 [#include <sys/types.h>
2426 #include <netinet/in.h>])
2427
2428 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
2429         AC_TRY_COMPILE(
2430                 [
2431 #include <sys/types.h>
2432                 ],
2433                 [ size_t foo; foo = 1235; ],
2434                 [ ac_cv_have_size_t="yes" ],
2435                 [ ac_cv_have_size_t="no" ]
2436         )
2437 ])
2438 if test "x$ac_cv_have_size_t" = "xyes" ; then
2439         AC_DEFINE(HAVE_SIZE_T, 1, [define if you have size_t data type])
2440 fi
2441
2442 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
2443         AC_TRY_COMPILE(
2444                 [
2445 #include <sys/types.h>
2446                 ],
2447                 [ ssize_t foo; foo = 1235; ],
2448                 [ ac_cv_have_ssize_t="yes" ],
2449                 [ ac_cv_have_ssize_t="no" ]
2450         )
2451 ])
2452 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
2453         AC_DEFINE(HAVE_SSIZE_T, 1, [define if you have ssize_t data type])
2454 fi
2455
2456 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
2457         AC_TRY_COMPILE(
2458                 [
2459 #include <time.h>
2460                 ],
2461                 [ clock_t foo; foo = 1235; ],
2462                 [ ac_cv_have_clock_t="yes" ],
2463                 [ ac_cv_have_clock_t="no" ]
2464         )
2465 ])
2466 if test "x$ac_cv_have_clock_t" = "xyes" ; then
2467         AC_DEFINE(HAVE_CLOCK_T, 1, [define if you have clock_t data type])
2468 fi
2469
2470 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
2471         AC_TRY_COMPILE(
2472                 [
2473 #include <sys/types.h>
2474 #include <sys/socket.h>
2475                 ],
2476                 [ sa_family_t foo; foo = 1235; ],
2477                 [ ac_cv_have_sa_family_t="yes" ],
2478                 [ AC_TRY_COMPILE(
2479                   [
2480 #include <sys/types.h>
2481 #include <sys/socket.h>
2482 #include <netinet/in.h>
2483                 ],
2484                 [ sa_family_t foo; foo = 1235; ],
2485                 [ ac_cv_have_sa_family_t="yes" ],
2486
2487                 [ ac_cv_have_sa_family_t="no" ]
2488         )]
2489         )
2490 ])
2491 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
2492         AC_DEFINE(HAVE_SA_FAMILY_T, 1,
2493                 [define if you have sa_family_t data type])
2494 fi
2495
2496 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
2497         AC_TRY_COMPILE(
2498                 [
2499 #include <sys/types.h>
2500                 ],
2501                 [ pid_t foo; foo = 1235; ],
2502                 [ ac_cv_have_pid_t="yes" ],
2503                 [ ac_cv_have_pid_t="no" ]
2504         )
2505 ])
2506 if test "x$ac_cv_have_pid_t" = "xyes" ; then
2507         AC_DEFINE(HAVE_PID_T, 1, [define if you have pid_t data type])
2508 fi
2509
2510 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
2511         AC_TRY_COMPILE(
2512                 [
2513 #include <sys/types.h>
2514                 ],
2515                 [ mode_t foo; foo = 1235; ],
2516                 [ ac_cv_have_mode_t="yes" ],
2517                 [ ac_cv_have_mode_t="no" ]
2518         )
2519 ])
2520 if test "x$ac_cv_have_mode_t" = "xyes" ; then
2521         AC_DEFINE(HAVE_MODE_T, 1, [define if you have mode_t data type])
2522 fi
2523
2524
2525 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
2526         AC_TRY_COMPILE(
2527                 [
2528 #include <sys/types.h>
2529 #include <sys/socket.h>
2530                 ],
2531                 [ struct sockaddr_storage s; ],
2532                 [ ac_cv_have_struct_sockaddr_storage="yes" ],
2533                 [ ac_cv_have_struct_sockaddr_storage="no" ]
2534         )
2535 ])
2536 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
2537         AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
2538                 [define if you have struct sockaddr_storage data type])
2539 fi
2540
2541 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
2542         AC_TRY_COMPILE(
2543                 [
2544 #include <sys/types.h>
2545 #include <netinet/in.h>
2546                 ],
2547                 [ struct sockaddr_in6 s; s.sin6_family = 0; ],
2548                 [ ac_cv_have_struct_sockaddr_in6="yes" ],
2549                 [ ac_cv_have_struct_sockaddr_in6="no" ]
2550         )
2551 ])
2552 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
2553         AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6, 1,
2554                 [define if you have struct sockaddr_in6 data type])
2555 fi
2556
2557 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
2558         AC_TRY_COMPILE(
2559                 [
2560 #include <sys/types.h>
2561 #include <netinet/in.h>
2562                 ],
2563                 [ struct in6_addr s; s.s6_addr[0] = 0; ],
2564                 [ ac_cv_have_struct_in6_addr="yes" ],
2565                 [ ac_cv_have_struct_in6_addr="no" ]
2566         )
2567 ])
2568 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
2569         AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1,
2570                 [define if you have struct in6_addr data type])
2571 fi
2572
2573 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
2574         AC_TRY_COMPILE(
2575                 [
2576 #include <sys/types.h>
2577 #include <sys/socket.h>
2578 #include <netdb.h>
2579                 ],
2580                 [ struct addrinfo s; s.ai_flags = AI_PASSIVE; ],
2581                 [ ac_cv_have_struct_addrinfo="yes" ],
2582                 [ ac_cv_have_struct_addrinfo="no" ]
2583         )
2584 ])
2585 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
2586         AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1,
2587                 [define if you have struct addrinfo data type])
2588 fi
2589
2590 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
2591         AC_TRY_COMPILE(
2592                 [ #include <sys/time.h> ],
2593                 [ struct timeval tv; tv.tv_sec = 1;],
2594                 [ ac_cv_have_struct_timeval="yes" ],
2595                 [ ac_cv_have_struct_timeval="no" ]
2596         )
2597 ])
2598 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
2599         AC_DEFINE(HAVE_STRUCT_TIMEVAL, 1, [define if you have struct timeval])
2600         have_struct_timeval=1
2601 fi
2602
2603 AC_CHECK_TYPES(struct timespec)
2604
2605 # We need int64_t or else certian parts of the compile will fail.
2606 if test "x$ac_cv_have_int64_t" = "xno" && \
2607         test "x$ac_cv_sizeof_long_int" != "x8" && \
2608         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
2609         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
2610         echo "an alternative compiler (I.E., GCC) before continuing."
2611         echo ""
2612         exit 1;
2613 else
2614 dnl test snprintf (broken on SCO w/gcc)
2615         AC_RUN_IFELSE(
2616                 [AC_LANG_SOURCE([[
2617 #include <stdio.h>
2618 #include <string.h>
2619 #ifdef HAVE_SNPRINTF
2620 main()
2621 {
2622         char buf[50];
2623         char expected_out[50];
2624         int mazsize = 50 ;
2625 #if (SIZEOF_LONG_INT == 8)
2626         long int num = 0x7fffffffffffffff;
2627 #else
2628         long long num = 0x7fffffffffffffffll;
2629 #endif
2630         strcpy(expected_out, "9223372036854775807");
2631         snprintf(buf, mazsize, "%lld", num);
2632         if(strcmp(buf, expected_out) != 0)
2633                 exit(1);
2634         exit(0);
2635 }
2636 #else
2637 main() { exit(0); }
2638 #endif
2639                 ]])], [ true ], [ AC_DEFINE(BROKEN_SNPRINTF) ],
2640                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
2641         )
2642 fi
2643
2644 dnl Checks for structure members
2645 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmp.h, HAVE_HOST_IN_UTMP)
2646 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmpx.h, HAVE_HOST_IN_UTMPX)
2647 OSSH_CHECK_HEADER_FOR_FIELD(syslen, utmpx.h, HAVE_SYSLEN_IN_UTMPX)
2648 OSSH_CHECK_HEADER_FOR_FIELD(ut_pid, utmp.h, HAVE_PID_IN_UTMP)
2649 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmp.h, HAVE_TYPE_IN_UTMP)
2650 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmpx.h, HAVE_TYPE_IN_UTMPX)
2651 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmp.h, HAVE_TV_IN_UTMP)
2652 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmp.h, HAVE_ID_IN_UTMP)
2653 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmpx.h, HAVE_ID_IN_UTMPX)
2654 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmp.h, HAVE_ADDR_IN_UTMP)
2655 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmpx.h, HAVE_ADDR_IN_UTMPX)
2656 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmp.h, HAVE_ADDR_V6_IN_UTMP)
2657 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmpx.h, HAVE_ADDR_V6_IN_UTMPX)
2658 OSSH_CHECK_HEADER_FOR_FIELD(ut_exit, utmp.h, HAVE_EXIT_IN_UTMP)
2659 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmp.h, HAVE_TIME_IN_UTMP)
2660 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmpx.h, HAVE_TIME_IN_UTMPX)
2661 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmpx.h, HAVE_TV_IN_UTMPX)
2662
2663 AC_CHECK_MEMBERS([struct stat.st_blksize])
2664 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE(__res_state, state,
2665         [Define if we don't have struct __res_state in resolv.h])],
2666 [
2667 #include <stdio.h>
2668 #if HAVE_SYS_TYPES_H
2669 # include <sys/types.h>
2670 #endif
2671 #include <netinet/in.h>
2672 #include <arpa/nameser.h>
2673 #include <resolv.h>
2674 ])
2675
2676 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
2677                 ac_cv_have_ss_family_in_struct_ss, [
2678         AC_TRY_COMPILE(
2679                 [
2680 #include <sys/types.h>
2681 #include <sys/socket.h>
2682                 ],
2683                 [ struct sockaddr_storage s; s.ss_family = 1; ],
2684                 [ ac_cv_have_ss_family_in_struct_ss="yes" ],
2685                 [ ac_cv_have_ss_family_in_struct_ss="no" ],
2686         )
2687 ])
2688 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
2689         AC_DEFINE(HAVE_SS_FAMILY_IN_SS, 1, [Fields in struct sockaddr_storage])
2690 fi
2691
2692 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
2693                 ac_cv_have___ss_family_in_struct_ss, [
2694         AC_TRY_COMPILE(
2695                 [
2696 #include <sys/types.h>
2697 #include <sys/socket.h>
2698                 ],
2699                 [ struct sockaddr_storage s; s.__ss_family = 1; ],
2700                 [ ac_cv_have___ss_family_in_struct_ss="yes" ],
2701                 [ ac_cv_have___ss_family_in_struct_ss="no" ]
2702         )
2703 ])
2704 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
2705         AC_DEFINE(HAVE___SS_FAMILY_IN_SS, 1,
2706                 [Fields in struct sockaddr_storage])
2707 fi
2708
2709 AC_CACHE_CHECK([for pw_class field in struct passwd],
2710                 ac_cv_have_pw_class_in_struct_passwd, [
2711         AC_TRY_COMPILE(
2712                 [
2713 #include <pwd.h>
2714                 ],
2715                 [ struct passwd p; p.pw_class = 0; ],
2716                 [ ac_cv_have_pw_class_in_struct_passwd="yes" ],
2717                 [ ac_cv_have_pw_class_in_struct_passwd="no" ]
2718         )
2719 ])
2720 if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
2721         AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD, 1,
2722                 [Define if your password has a pw_class field])
2723 fi
2724
2725 AC_CACHE_CHECK([for pw_expire field in struct passwd],
2726                 ac_cv_have_pw_expire_in_struct_passwd, [
2727         AC_TRY_COMPILE(
2728                 [
2729 #include <pwd.h>
2730                 ],
2731                 [ struct passwd p; p.pw_expire = 0; ],
2732                 [ ac_cv_have_pw_expire_in_struct_passwd="yes" ],
2733                 [ ac_cv_have_pw_expire_in_struct_passwd="no" ]
2734         )
2735 ])
2736 if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
2737         AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD, 1,
2738                 [Define if your password has a pw_expire field])
2739 fi
2740
2741 AC_CACHE_CHECK([for pw_change field in struct passwd],
2742                 ac_cv_have_pw_change_in_struct_passwd, [
2743         AC_TRY_COMPILE(
2744                 [
2745 #include <pwd.h>
2746                 ],
2747                 [ struct passwd p; p.pw_change = 0; ],
2748                 [ ac_cv_have_pw_change_in_struct_passwd="yes" ],
2749                 [ ac_cv_have_pw_change_in_struct_passwd="no" ]
2750         )
2751 ])
2752 if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
2753         AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD, 1,
2754                 [Define if your password has a pw_change field])
2755 fi
2756
2757 dnl make sure we're using the real structure members and not defines
2758 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
2759                 ac_cv_have_accrights_in_msghdr, [
2760         AC_COMPILE_IFELSE(
2761                 [
2762 #include <sys/types.h>
2763 #include <sys/socket.h>
2764 #include <sys/uio.h>
2765 int main() {
2766 #ifdef msg_accrights
2767 #error "msg_accrights is a macro"
2768 exit(1);
2769 #endif
2770 struct msghdr m;
2771 m.msg_accrights = 0;
2772 exit(0);
2773 }
2774                 ],
2775                 [ ac_cv_have_accrights_in_msghdr="yes" ],
2776                 [ ac_cv_have_accrights_in_msghdr="no" ]
2777         )
2778 ])
2779 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
2780         AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR, 1,
2781                 [Define if your system uses access rights style
2782                 file descriptor passing])
2783 fi
2784
2785 AC_CACHE_CHECK([for msg_control field in struct msghdr],
2786                 ac_cv_have_control_in_msghdr, [
2787         AC_COMPILE_IFELSE(
2788                 [
2789 #include <sys/types.h>
2790 #include <sys/socket.h>
2791 #include <sys/uio.h>
2792 int main() {
2793 #ifdef msg_control
2794 #error "msg_control is a macro"
2795 exit(1);
2796 #endif
2797 struct msghdr m;
2798 m.msg_control = 0;
2799 exit(0);
2800 }
2801                 ],
2802                 [ ac_cv_have_control_in_msghdr="yes" ],
2803                 [ ac_cv_have_control_in_msghdr="no" ]
2804         )
2805 ])
2806 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
2807         AC_DEFINE(HAVE_CONTROL_IN_MSGHDR, 1,
2808                 [Define if your system uses ancillary data style
2809                 file descriptor passing])
2810 fi
2811
2812 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
2813         AC_TRY_LINK([],
2814                 [ extern char *__progname; printf("%s", __progname); ],
2815                 [ ac_cv_libc_defines___progname="yes" ],
2816                 [ ac_cv_libc_defines___progname="no" ]
2817         )
2818 ])
2819 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
2820         AC_DEFINE(HAVE___PROGNAME, 1, [Define if libc defines __progname])
2821 fi
2822
2823 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
2824         AC_TRY_LINK([
2825 #include <stdio.h>
2826 ],
2827                 [ printf("%s", __FUNCTION__); ],
2828                 [ ac_cv_cc_implements___FUNCTION__="yes" ],
2829                 [ ac_cv_cc_implements___FUNCTION__="no" ]
2830         )
2831 ])
2832 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
2833         AC_DEFINE(HAVE___FUNCTION__, 1,
2834                 [Define if compiler implements __FUNCTION__])
2835 fi
2836
2837 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
2838         AC_TRY_LINK([
2839 #include <stdio.h>
2840 ],
2841                 [ printf("%s", __func__); ],
2842                 [ ac_cv_cc_implements___func__="yes" ],
2843                 [ ac_cv_cc_implements___func__="no" ]
2844         )
2845 ])
2846 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
2847         AC_DEFINE(HAVE___func__, 1, [Define if compiler implements __func__])
2848 fi
2849
2850 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
2851         AC_TRY_LINK(
2852                 [#include <stdarg.h>
2853                  va_list x,y;],
2854                 [va_copy(x,y);],
2855                 [ ac_cv_have_va_copy="yes" ],
2856                 [ ac_cv_have_va_copy="no" ]
2857         )
2858 ])
2859 if test "x$ac_cv_have_va_copy" = "xyes" ; then
2860         AC_DEFINE(HAVE_VA_COPY, 1, [Define if va_copy exists])
2861 fi
2862
2863 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
2864         AC_TRY_LINK(
2865                 [#include <stdarg.h>
2866                  va_list x,y;],
2867                 [__va_copy(x,y);],
2868                 [ ac_cv_have___va_copy="yes" ],
2869                 [ ac_cv_have___va_copy="no" ]
2870         )
2871 ])
2872 if test "x$ac_cv_have___va_copy" = "xyes" ; then
2873         AC_DEFINE(HAVE___VA_COPY, 1, [Define if __va_copy exists])
2874 fi
2875
2876 AC_CACHE_CHECK([whether getopt has optreset support],
2877                 ac_cv_have_getopt_optreset, [
2878         AC_TRY_LINK(
2879                 [
2880 #include <getopt.h>
2881                 ],
2882                 [ extern int optreset; optreset = 0; ],
2883                 [ ac_cv_have_getopt_optreset="yes" ],
2884                 [ ac_cv_have_getopt_optreset="no" ]
2885         )
2886 ])
2887 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
2888         AC_DEFINE(HAVE_GETOPT_OPTRESET, 1,
2889                 [Define if your getopt(3) defines and uses optreset])
2890 fi
2891
2892 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
2893         AC_TRY_LINK([],
2894                 [ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);],
2895                 [ ac_cv_libc_defines_sys_errlist="yes" ],
2896                 [ ac_cv_libc_defines_sys_errlist="no" ]
2897         )
2898 ])
2899 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
2900         AC_DEFINE(HAVE_SYS_ERRLIST, 1,
2901                 [Define if your system defines sys_errlist[]])
2902 fi
2903
2904
2905 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
2906         AC_TRY_LINK([],
2907                 [ extern int sys_nerr; printf("%i", sys_nerr);],
2908                 [ ac_cv_libc_defines_sys_nerr="yes" ],
2909                 [ ac_cv_libc_defines_sys_nerr="no" ]
2910         )
2911 ])
2912 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
2913         AC_DEFINE(HAVE_SYS_NERR, 1, [Define if your system defines sys_nerr])
2914 fi
2915
2916 SCARD_MSG="no"
2917 # Check whether user wants sectok support
2918 AC_ARG_WITH(sectok,
2919         [  --with-sectok           Enable smartcard support using libsectok],
2920         [
2921                 if test "x$withval" != "xno" ; then
2922                         if test "x$withval" != "xyes" ; then
2923                                 CPPFLAGS="$CPPFLAGS -I${withval}"
2924                                 LDFLAGS="$LDFLAGS -L${withval}"
2925                                 if test ! -z "$need_dash_r" ; then
2926                                         LDFLAGS="$LDFLAGS -R${withval}"
2927                                 fi
2928                                 if test ! -z "$blibpath" ; then
2929                                         blibpath="$blibpath:${withval}"
2930                                 fi
2931                         fi
2932                         AC_CHECK_HEADERS(sectok.h)
2933                         if test "$ac_cv_header_sectok_h" != yes; then
2934                                 AC_MSG_ERROR(Can't find sectok.h)
2935                         fi
2936                         AC_CHECK_LIB(sectok, sectok_open)
2937                         if test "$ac_cv_lib_sectok_sectok_open" != yes; then
2938                                 AC_MSG_ERROR(Can't find libsectok)
2939                         fi
2940                         AC_DEFINE(SMARTCARD, 1,
2941                                 [Define if you want smartcard support])
2942                         AC_DEFINE(USE_SECTOK, 1,
2943                                 [Define if you want smartcard support
2944                                 using sectok])
2945                         SCARD_MSG="yes, using sectok"
2946                 fi
2947         ]
2948 )
2949
2950 # Check whether user wants OpenSC support
2951 OPENSC_CONFIG="no"
2952 AC_ARG_WITH(opensc,
2953         [  --with-opensc[[=PFX]]     Enable smartcard support using OpenSC (optionally in PATH)],
2954         [
2955             if test "x$withval" != "xno" ; then
2956                 if test "x$withval" != "xyes" ; then
2957                         OPENSC_CONFIG=$withval/bin/opensc-config
2958                 else
2959                         AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
2960                 fi
2961                 if test "$OPENSC_CONFIG" != "no"; then
2962                         LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
2963                         LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
2964                         CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
2965                         LDFLAGS="$LDFLAGS $LIBOPENSC_LIBS"
2966                         AC_DEFINE(SMARTCARD)
2967                         AC_DEFINE(USE_OPENSC, 1,
2968                                 [Define if you want smartcard support
2969                                 using OpenSC])
2970                         SCARD_MSG="yes, using OpenSC"
2971                 fi
2972             fi
2973         ]
2974 )
2975
2976 # Check libraries needed by DNS fingerprint support
2977 AC_SEARCH_LIBS(getrrsetbyname, resolv,
2978         [AC_DEFINE(HAVE_GETRRSETBYNAME, 1,
2979                 [Define if getrrsetbyname() exists])],
2980         [
2981                 # Needed by our getrrsetbyname()
2982                 AC_SEARCH_LIBS(res_query, resolv)
2983                 AC_SEARCH_LIBS(dn_expand, resolv)
2984                 AC_MSG_CHECKING(if res_query will link)
2985                 AC_TRY_LINK_FUNC(res_query, AC_MSG_RESULT(yes),
2986                    [AC_MSG_RESULT(no)
2987                     saved_LIBS="$LIBS"
2988                     LIBS="$LIBS -lresolv"
2989                     AC_MSG_CHECKING(for res_query in -lresolv)
2990                     AC_LINK_IFELSE([
2991 #include <resolv.h>
2992 int main()
2993 {
2994         res_query (0, 0, 0, 0, 0);
2995         return 0;
2996 }
2997                         ],
2998                         [LIBS="$LIBS -lresolv"
2999                          AC_MSG_RESULT(yes)],
3000                         [LIBS="$saved_LIBS"
3001                          AC_MSG_RESULT(no)])
3002                     ])
3003                 AC_CHECK_FUNCS(_getshort _getlong)
3004                 AC_CHECK_DECLS([_getshort, _getlong], , ,
3005                     [#include <sys/types.h>
3006                     #include <arpa/nameser.h>])
3007                 AC_CHECK_MEMBER(HEADER.ad,
3008                         [AC_DEFINE(HAVE_HEADER_AD, 1,
3009                             [Define if HEADER.ad exists in arpa/nameser.h])],,
3010                         [#include <arpa/nameser.h>])
3011         ])
3012
3013 # Check whether user wants SELinux support
3014 SELINUX_MSG="no"
3015 LIBSELINUX=""
3016 AC_ARG_WITH(selinux,
3017         [  --with-selinux   Enable SELinux support],
3018         [ if test "x$withval" != "xno" ; then
3019                 AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
3020                 SELINUX_MSG="yes"
3021                 AC_CHECK_HEADER([selinux/selinux.h], ,
3022                     AC_MSG_ERROR(SELinux support requires selinux.h header))
3023                 AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
3024                     AC_MSG_ERROR(SELinux support requires libselinux library))
3025                 AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
3026         fi ]
3027 )
3028 AC_SUBST(LIBSELINUX)
3029
3030 # Check whether user wants Kerberos 5 support
3031 KRB5_MSG="no"
3032 AC_ARG_WITH(kerberos5,
3033         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
3034         [ if test "x$withval" != "xno" ; then
3035                 if test "x$withval" = "xyes" ; then
3036                         KRB5ROOT="/usr/local"
3037                 else
3038                         KRB5ROOT=${withval}
3039                 fi
3040
3041                 AC_DEFINE(KRB5, 1, [Define if you want Kerberos 5 support])
3042                 KRB5_MSG="yes"
3043
3044                 AC_MSG_CHECKING(for krb5-config)
3045                 if test -x  $KRB5ROOT/bin/krb5-config ; then
3046                         KRB5CONF=$KRB5ROOT/bin/krb5-config
3047                         AC_MSG_RESULT($KRB5CONF)
3048
3049                         AC_MSG_CHECKING(for gssapi support)
3050                         if $KRB5CONF | grep gssapi >/dev/null ; then
3051                                 AC_MSG_RESULT(yes)
3052                                 AC_DEFINE(GSSAPI, 1,
3053                                         [Define this if you want GSSAPI
3054                                         support in the version 2 protocol])
3055                                 k5confopts=gssapi
3056                         else
3057                                 AC_MSG_RESULT(no)
3058                                 k5confopts=""
3059                         fi
3060                         K5CFLAGS="`$KRB5CONF --cflags $k5confopts`"
3061                         K5LIBS="`$KRB5CONF --libs $k5confopts`"
3062                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
3063                         AC_MSG_CHECKING(whether we are using Heimdal)
3064                         AC_TRY_COMPILE([ #include <krb5.h> ],
3065                                        [ char *tmp = heimdal_version; ],
3066                                        [ AC_MSG_RESULT(yes)
3067                                          AC_DEFINE(HEIMDAL, 1,
3068                                         [Define this if you are using the
3069                                         Heimdal version of Kerberos V5]) ],
3070                                          AC_MSG_RESULT(no)
3071                         )
3072                 else
3073                         AC_MSG_RESULT(no)
3074                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
3075                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
3076                         AC_MSG_CHECKING(whether we are using Heimdal)
3077                         AC_TRY_COMPILE([ #include <krb5.h> ],
3078                                        [ char *tmp = heimdal_version; ],
3079                                        [ AC_MSG_RESULT(yes)
3080                                          AC_DEFINE(HEIMDAL)
3081                                          K5LIBS="-lkrb5 -ldes"
3082                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
3083                                          AC_CHECK_LIB(roken, net_write,
3084                                            [K5LIBS="$K5LIBS -lroken"])
3085                                        ],
3086                                        [ AC_MSG_RESULT(no)
3087                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
3088                                        ]
3089                         )
3090                         AC_SEARCH_LIBS(dn_expand, resolv)
3091
3092                         AC_CHECK_LIB(gssapi,gss_init_sec_context,
3093                                 [ AC_DEFINE(GSSAPI)
3094                                   K5LIBS="-lgssapi $K5LIBS" ],
3095                                 [ AC_CHECK_LIB(gssapi_krb5,gss_init_sec_context,
3096                                         [ AC_DEFINE(GSSAPI)
3097                                           K5LIBS="-lgssapi_krb5 $K5LIBS" ],
3098                                         AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]),
3099                                         $K5LIBS)
3100                                 ],
3101                                 $K5LIBS)
3102
3103                         AC_CHECK_HEADER(gssapi.h, ,
3104                                 [ unset ac_cv_header_gssapi_h
3105                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3106                                   AC_CHECK_HEADERS(gssapi.h, ,
3107                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
3108                                   )
3109                                 ]
3110                         )
3111
3112                         oldCPP="$CPPFLAGS"
3113                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3114                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3115                                         [ CPPFLAGS="$oldCPP" ])
3116
3117                 fi
3118                 if test ! -z "$need_dash_r" ; then
3119                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
3120                 fi
3121                 if test ! -z "$blibpath" ; then
3122                         blibpath="$blibpath:${KRB5ROOT}/lib"
3123                 fi
3124
3125                 AC_CHECK_HEADERS(gssapi.h gssapi/gssapi.h)
3126                 AC_CHECK_HEADERS(gssapi_krb5.h gssapi/gssapi_krb5.h)
3127                 AC_CHECK_HEADERS(gssapi_generic.h gssapi/gssapi_generic.h)
3128
3129                 LIBS="$LIBS $K5LIBS"
3130                 AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS, 1,
3131                         [Define this if you want to use libkafs' AFS support]))
3132         fi
3133         ]
3134 )
3135
3136 # Looking for programs, paths and files
3137
3138 PRIVSEP_PATH=/var/empty
3139 AC_ARG_WITH(privsep-path,
3140         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
3141         [
3142                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3143                     test "x${withval}" != "xyes"; then
3144                         PRIVSEP_PATH=$withval
3145                 fi
3146         ]
3147 )
3148 AC_SUBST(PRIVSEP_PATH)
3149
3150 AC_ARG_WITH(xauth,
3151         [  --with-xauth=PATH       Specify path to xauth program ],
3152         [
3153                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3154                     test "x${withval}" != "xyes"; then
3155                         xauth_path=$withval
3156                 fi
3157         ],
3158         [
3159                 TestPath="$PATH"
3160                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
3161                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
3162                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
3163                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
3164                 AC_PATH_PROG(xauth_path, xauth, , $TestPath)
3165                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
3166                         xauth_path="/usr/openwin/bin/xauth"
3167                 fi
3168         ]
3169 )
3170
3171 STRIP_OPT=-s
3172 AC_ARG_ENABLE(strip,
3173         [  --disable-strip         Disable calling strip(1) on install],
3174         [
3175                 if test "x$enableval" = "xno" ; then
3176                         STRIP_OPT=
3177                 fi
3178         ]
3179 )
3180 AC_SUBST(STRIP_OPT)
3181
3182 if test -z "$xauth_path" ; then
3183         XAUTH_PATH="undefined"
3184         AC_SUBST(XAUTH_PATH)
3185 else
3186         AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path",
3187                 [Define if xauth is found in your path])
3188         XAUTH_PATH=$xauth_path
3189         AC_SUBST(XAUTH_PATH)
3190 fi
3191
3192 # Check for mail directory (last resort if we cannot get it from headers)
3193 if test ! -z "$MAIL" ; then
3194         maildir=`dirname $MAIL`
3195         AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir",
3196                 [Set this to your mail directory if you don't have maillock.h])
3197 fi
3198
3199 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
3200         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
3201         disable_ptmx_check=yes
3202 fi
3203 if test -z "$no_dev_ptmx" ; then
3204         if test "x$disable_ptmx_check" != "xyes" ; then
3205                 AC_CHECK_FILE("/dev/ptmx",
3206                         [
3207                                 AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX, 1,
3208                                         [Define if you have /dev/ptmx])
3209                                 have_dev_ptmx=1
3210                         ]
3211                 )
3212         fi
3213 fi
3214
3215 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
3216         AC_CHECK_FILE("/dev/ptc",
3217                 [
3218                         AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC, 1,
3219                                 [Define if you have /dev/ptc])
3220                         have_dev_ptc=1
3221                 ]
3222         )
3223 else
3224         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
3225 fi
3226
3227 # Options from here on. Some of these are preset by platform above
3228 AC_ARG_WITH(mantype,
3229         [  --with-mantype=man|cat|doc  Set man page type],
3230         [
3231                 case "$withval" in
3232                 man|cat|doc)
3233                         MANTYPE=$withval
3234                         ;;
3235                 *)
3236                         AC_MSG_ERROR(invalid man type: $withval)
3237                         ;;
3238                 esac
3239         ]
3240 )
3241 if test -z "$MANTYPE"; then
3242         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
3243         AC_PATH_PROGS(NROFF, nroff awf, /bin/false, $TestPath)
3244         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
3245                 MANTYPE=doc
3246         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
3247                 MANTYPE=man
3248         else
3249                 MANTYPE=cat
3250         fi
3251 fi
3252 AC_SUBST(MANTYPE)
3253 if test "$MANTYPE" = "doc"; then
3254         mansubdir=man;
3255 else
3256         mansubdir=$MANTYPE;
3257 fi
3258 AC_SUBST(mansubdir)
3259
3260 # Check whether to enable MD5 passwords
3261 MD5_MSG="no"
3262 AC_ARG_WITH(md5-passwords,
3263         [  --with-md5-passwords    Enable use of MD5 passwords],
3264         [
3265                 if test "x$withval" != "xno" ; then
3266                         AC_DEFINE(HAVE_MD5_PASSWORDS, 1,
3267                                 [Define if you want to allow MD5 passwords])
3268                         MD5_MSG="yes"
3269                 fi
3270         ]
3271 )
3272
3273 # Whether to disable shadow password support
3274 AC_ARG_WITH(shadow,
3275         [  --without-shadow        Disable shadow password support],
3276         [
3277                 if test "x$withval" = "xno" ; then
3278                         AC_DEFINE(DISABLE_SHADOW)
3279                         disable_shadow=yes
3280                 fi
3281         ]
3282 )
3283
3284 if test -z "$disable_shadow" ; then
3285         AC_MSG_CHECKING([if the systems has expire shadow information])
3286         AC_TRY_COMPILE(
3287         [
3288 #include <sys/types.h>
3289 #include <shadow.h>
3290         struct spwd sp;
3291         ],[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ],
3292         [ sp_expire_available=yes ], []
3293         )
3294
3295         if test "x$sp_expire_available" = "xyes" ; then
3296                 AC_MSG_RESULT(yes)
3297                 AC_DEFINE(HAS_SHADOW_EXPIRE, 1,
3298                     [Define if you want to use shadow password expire field])
3299         else
3300                 AC_MSG_RESULT(no)
3301         fi
3302 fi
3303
3304 # Use ip address instead of hostname in $DISPLAY
3305 if test ! -z "$IPADDR_IN_DISPLAY" ; then
3306         DISPLAY_HACK_MSG="yes"
3307         AC_DEFINE(IPADDR_IN_DISPLAY, 1,
3308                 [Define if you need to use IP address
3309                 instead of hostname in $DISPLAY])
3310 else
3311         DISPLAY_HACK_MSG="no"
3312         AC_ARG_WITH(ipaddr-display,
3313                 [  --with-ipaddr-display   Use ip address instead of hostname in \$DISPLAY],
3314                 [
3315                         if test "x$withval" != "xno" ; then
3316                                 AC_DEFINE(IPADDR_IN_DISPLAY)
3317                                 DISPLAY_HACK_MSG="yes"
3318                         fi
3319                 ]
3320         )
3321 fi
3322
3323 # check for /etc/default/login and use it if present.
3324 AC_ARG_ENABLE(etc-default-login,
3325         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
3326         [ if test "x$enableval" = "xno"; then
3327                 AC_MSG_NOTICE([/etc/default/login handling disabled])
3328                 etc_default_login=no
3329           else
3330                 etc_default_login=yes
3331           fi ],
3332         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
3333           then
3334                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
3335                 etc_default_login=no
3336           else
3337                 etc_default_login=yes
3338           fi ]
3339 )
3340
3341 if test "x$etc_default_login" != "xno"; then
3342         AC_CHECK_FILE("/etc/default/login",
3343             [ external_path_file=/etc/default/login ])
3344         if test "x$external_path_file" = "x/etc/default/login"; then
3345                 AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN, 1,
3346                         [Define if your system has /etc/default/login])
3347         fi
3348 fi
3349
3350 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
3351 if test $ac_cv_func_login_getcapbool = "yes" && \
3352         test $ac_cv_header_login_cap_h = "yes" ; then
3353         external_path_file=/etc/login.conf
3354 fi
3355
3356 # Whether to mess with the default path
3357 SERVER_PATH_MSG="(default)"
3358 AC_ARG_WITH(default-path,
3359         [  --with-default-path=    Specify default \$PATH environment for server],
3360         [
3361                 if test "x$external_path_file" = "x/etc/login.conf" ; then
3362                         AC_MSG_WARN([
3363 --with-default-path=PATH has no effect on this system.
3364 Edit /etc/login.conf instead.])
3365                 elif test "x$withval" != "xno" ; then
3366                         if test ! -z "$external_path_file" ; then
3367                                 AC_MSG_WARN([
3368 --with-default-path=PATH will only be used if PATH is not defined in
3369 $external_path_file .])
3370                         fi
3371                         user_path="$withval"
3372                         SERVER_PATH_MSG="$withval"
3373                 fi
3374         ],
3375         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
3376                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
3377         else
3378                 if test ! -z "$external_path_file" ; then
3379                         AC_MSG_WARN([
3380 If PATH is defined in $external_path_file, ensure the path to scp is included,
3381 otherwise scp will not work.])
3382                 fi
3383                 AC_RUN_IFELSE(
3384                         [AC_LANG_SOURCE([[
3385 /* find out what STDPATH is */
3386 #include <stdio.h>
3387 #ifdef HAVE_PATHS_H
3388 # include <paths.h>
3389 #endif
3390 #ifndef _PATH_STDPATH
3391 # ifdef _PATH_USERPATH  /* Irix */
3392 #  define _PATH_STDPATH _PATH_USERPATH
3393 # else
3394 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
3395 # endif
3396 #endif
3397 #include <sys/types.h>
3398 #include <sys/stat.h>
3399 #include <fcntl.h>
3400 #define DATA "conftest.stdpath"
3401
3402 main()
3403 {
3404         FILE *fd;
3405         int rc;
3406
3407         fd = fopen(DATA,"w");
3408         if(fd == NULL)
3409                 exit(1);
3410
3411         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
3412                 exit(1);
3413
3414         exit(0);
3415 }
3416                 ]])],
3417                 [ user_path=`cat conftest.stdpath` ],
3418                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
3419                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
3420         )
3421 # make sure $bindir is in USER_PATH so scp will work
3422                 t_bindir=`eval echo ${bindir}`
3423                 case $t_bindir in
3424                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
3425                 esac
3426                 case $t_bindir in
3427                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
3428                 esac
3429                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
3430                 if test $? -ne 0  ; then
3431                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
3432                         if test $? -ne 0  ; then
3433                                 user_path=$user_path:$t_bindir
3434                                 AC_MSG_RESULT(Adding $t_bindir to USER_PATH so scp will work)
3435                         fi
3436                 fi
3437         fi ]
3438 )
3439 if test "x$external_path_file" != "x/etc/login.conf" ; then
3440         AC_DEFINE_UNQUOTED(USER_PATH, "$user_path", [Specify default $PATH])
3441         AC_SUBST(user_path)
3442 fi
3443
3444 # Set superuser path separately to user path
3445 AC_ARG_WITH(superuser-path,
3446         [  --with-superuser-path=  Specify different path for super-user],
3447         [
3448                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3449                     test "x${withval}" != "xyes"; then
3450                         AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval",
3451                                 [Define if you want a different $PATH
3452                                 for the superuser])
3453                         superuser_path=$withval
3454                 fi
3455         ]
3456 )
3457
3458
3459 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
3460 IPV4_IN6_HACK_MSG="no"
3461 AC_ARG_WITH(4in6,
3462         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
3463         [
3464                 if test "x$withval" != "xno" ; then
3465                         AC_MSG_RESULT(yes)
3466                         AC_DEFINE(IPV4_IN_IPV6, 1,
3467                                 [Detect IPv4 in IPv6 mapped addresses
3468                                 and treat as IPv4])
3469                         IPV4_IN6_HACK_MSG="yes"
3470                 else
3471                         AC_MSG_RESULT(no)
3472                 fi
3473         ],[
3474                 if test "x$inet6_default_4in6" = "xyes"; then
3475                         AC_MSG_RESULT([yes (default)])
3476                         AC_DEFINE(IPV4_IN_IPV6)
3477                         IPV4_IN6_HACK_MSG="yes"
3478                 else
3479                         AC_MSG_RESULT([no (default)])
3480                 fi
3481         ]
3482 )
3483
3484 # Whether to enable BSD auth support
3485 BSD_AUTH_MSG=no
3486 AC_ARG_WITH(bsd-auth,
3487         [  --with-bsd-auth         Enable BSD auth support],
3488         [
3489                 if test "x$withval" != "xno" ; then
3490                         AC_DEFINE(BSD_AUTH, 1,
3491                                 [Define if you have BSD auth support])
3492                         BSD_AUTH_MSG=yes
3493                 fi
3494         ]
3495 )
3496
3497 # Where to place sshd.pid
3498 piddir=/var/run
3499 # make sure the directory exists
3500 if test ! -d $piddir ; then
3501         piddir=`eval echo ${sysconfdir}`
3502         case $piddir in
3503                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
3504         esac
3505 fi
3506
3507 AC_ARG_WITH(pid-dir,
3508         [  --with-pid-dir=PATH     Specify location of ssh.pid file],
3509         [
3510                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3511                     test "x${withval}" != "xyes"; then
3512                         piddir=$withval
3513                         if test ! -d $piddir ; then
3514                         AC_MSG_WARN([** no $piddir directory on this system **])
3515                         fi
3516                 fi
3517         ]
3518 )
3519
3520 AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir", [Specify location of ssh.pid])
3521 AC_SUBST(piddir)
3522
3523 dnl allow user to disable some login recording features
3524 AC_ARG_ENABLE(lastlog,
3525         [  --disable-lastlog       disable use of lastlog even if detected [no]],
3526         [
3527                 if test "x$enableval" = "xno" ; then
3528                         AC_DEFINE(DISABLE_LASTLOG)
3529                 fi
3530         ]
3531 )
3532 AC_ARG_ENABLE(utmp,
3533         [  --disable-utmp          disable use of utmp even if detected [no]],
3534         [
3535                 if test "x$enableval" = "xno" ; then
3536                         AC_DEFINE(DISABLE_UTMP)
3537                 fi
3538         ]
3539 )
3540 AC_ARG_ENABLE(utmpx,
3541         [  --disable-utmpx         disable use of utmpx even if detected [no]],
3542         [
3543                 if test "x$enableval" = "xno" ; then
3544                         AC_DEFINE(DISABLE_UTMPX, 1,
3545                                 [Define if you don't want to use utmpx])
3546                 fi
3547         ]
3548 )
3549 AC_ARG_ENABLE(wtmp,
3550         [  --disable-wtmp          disable use of wtmp even if detected [no]],
3551         [
3552                 if test "x$enableval" = "xno" ; then
3553                         AC_DEFINE(DISABLE_WTMP)
3554                 fi
3555         ]
3556 )
3557 AC_ARG_ENABLE(wtmpx,
3558         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
3559         [
3560                 if test "x$enableval" = "xno" ; then
3561                         AC_DEFINE(DISABLE_WTMPX, 1,
3562                                 [Define if you don't want to use wtmpx])
3563                 fi
3564         ]
3565 )
3566 AC_ARG_ENABLE(libutil,
3567         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
3568         [
3569                 if test "x$enableval" = "xno" ; then
3570                         AC_DEFINE(DISABLE_LOGIN)
3571                 fi
3572         ]
3573 )
3574 AC_ARG_ENABLE(pututline,
3575         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
3576         [
3577                 if test "x$enableval" = "xno" ; then
3578                         AC_DEFINE(DISABLE_PUTUTLINE, 1,
3579                                 [Define if you don't want to use pututline()
3580                                 etc. to write [uw]tmp])
3581                 fi
3582         ]
3583 )
3584 AC_ARG_ENABLE(pututxline,
3585         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
3586         [
3587                 if test "x$enableval" = "xno" ; then
3588                         AC_DEFINE(DISABLE_PUTUTXLINE, 1,
3589                                 [Define if you don't want to use pututxline()
3590                                 etc. to write [uw]tmpx])
3591                 fi
3592         ]
3593 )
3594 AC_ARG_WITH(lastlog,
3595   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
3596         [
3597                 if test "x$withval" = "xno" ; then
3598                         AC_DEFINE(DISABLE_LASTLOG)
3599                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
3600                         conf_lastlog_location=$withval
3601                 fi
3602         ]
3603 )
3604
3605 dnl lastlog, [uw]tmpx? detection
3606 dnl  NOTE: set the paths in the platform section to avoid the
3607 dnl   need for command-line parameters
3608 dnl lastlog and [uw]tmp are subject to a file search if all else fails
3609
3610 dnl lastlog detection
3611 dnl  NOTE: the code itself will detect if lastlog is a directory
3612 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
3613 AC_TRY_COMPILE([
3614 #include <sys/types.h>
3615 #include <utmp.h>
3616 #ifdef HAVE_LASTLOG_H
3617 #  include <lastlog.h>
3618 #endif
3619 #ifdef HAVE_PATHS_H
3620 #  include <paths.h>
3621 #endif
3622 #ifdef HAVE_LOGIN_H
3623 # include <login.h>
3624 #endif
3625         ],
3626         [ char *lastlog = LASTLOG_FILE; ],
3627         [ AC_MSG_RESULT(yes) ],
3628         [
3629                 AC_MSG_RESULT(no)
3630                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
3631                 AC_TRY_COMPILE([
3632 #include <sys/types.h>
3633 #include <utmp.h>
3634 #ifdef HAVE_LASTLOG_H
3635 #  include <lastlog.h>
3636 #endif
3637 #ifdef HAVE_PATHS_H
3638 #  include <paths.h>
3639 #endif
3640                 ],
3641                 [ char *lastlog = _PATH_LASTLOG; ],
3642                 [ AC_MSG_RESULT(yes) ],
3643                 [
3644                         AC_MSG_RESULT(no)
3645                         system_lastlog_path=no
3646                 ])
3647         ]
3648 )
3649
3650 if test -z "$conf_lastlog_location"; then
3651         if test x"$system_lastlog_path" = x"no" ; then
3652                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
3653                                 if (test -d "$f" || test -f "$f") ; then
3654                                         conf_lastlog_location=$f
3655                                 fi
3656                 done
3657                 if test -z "$conf_lastlog_location"; then
3658                         AC_MSG_WARN([** Cannot find lastlog **])
3659                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
3660                 fi
3661         fi
3662 fi
3663
3664 if test -n "$conf_lastlog_location"; then
3665         AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location",
3666                 [Define if you want to specify the path to your lastlog file])
3667 fi
3668
3669 dnl utmp detection
3670 AC_MSG_CHECKING([if your system defines UTMP_FILE])
3671 AC_TRY_COMPILE([
3672 #include <sys/types.h>
3673 #include <utmp.h>
3674 #ifdef HAVE_PATHS_H
3675 #  include <paths.h>
3676 #endif
3677         ],
3678         [ char *utmp = UTMP_FILE; ],
3679         [ AC_MSG_RESULT(yes) ],
3680         [ AC_MSG_RESULT(no)
3681           system_utmp_path=no ]
3682 )
3683 if test -z "$conf_utmp_location"; then
3684         if test x"$system_utmp_path" = x"no" ; then
3685                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
3686                         if test -f $f ; then
3687                                 conf_utmp_location=$f
3688                         fi
3689                 done
3690                 if test -z "$conf_utmp_location"; then
3691                         AC_DEFINE(DISABLE_UTMP)
3692                 fi
3693         fi
3694 fi
3695 if test -n "$conf_utmp_location"; then
3696         AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location",
3697                 [Define if you want to specify the path to your utmp file])
3698 fi
3699
3700 dnl wtmp detection
3701 AC_MSG_CHECKING([if your system defines WTMP_FILE])
3702 AC_TRY_COMPILE([
3703 #include <sys/types.h>
3704 #include <utmp.h>
3705 #ifdef HAVE_PATHS_H
3706 #  include <paths.h>
3707 #endif
3708         ],
3709         [ char *wtmp = WTMP_FILE; ],
3710         [ AC_MSG_RESULT(yes) ],
3711         [ AC_MSG_RESULT(no)
3712           system_wtmp_path=no ]
3713 )
3714 if test -z "$conf_wtmp_location"; then
3715         if test x"$system_wtmp_path" = x"no" ; then
3716                 for f in /usr/adm/wtmp /var/log/wtmp; do
3717                         if test -f $f ; then
3718                                 conf_wtmp_location=$f
3719                         fi
3720                 done
3721                 if test -z "$conf_wtmp_location"; then
3722                         AC_DEFINE(DISABLE_WTMP)
3723                 fi
3724         fi
3725 fi
3726 if test -n "$conf_wtmp_location"; then
3727         AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location",
3728                 [Define if you want to specify the path to your wtmp file])
3729 fi
3730
3731
3732 dnl utmpx detection - I don't know any system so perverse as to require
3733 dnl  utmpx, but not define UTMPX_FILE (ditto wtmpx.) No doubt it's out
3734 dnl  there, though.
3735 AC_MSG_CHECKING([if your system defines UTMPX_FILE])
3736 AC_TRY_COMPILE([
3737 #include <sys/types.h>
3738 #include <utmp.h>
3739 #ifdef HAVE_UTMPX_H
3740 #include <utmpx.h>
3741 #endif
3742 #ifdef HAVE_PATHS_H
3743 #  include <paths.h>
3744 #endif
3745         ],
3746         [ char *utmpx = UTMPX_FILE; ],
3747         [ AC_MSG_RESULT(yes) ],
3748         [ AC_MSG_RESULT(no)
3749           system_utmpx_path=no ]
3750 )
3751 if test -z "$conf_utmpx_location"; then
3752         if test x"$system_utmpx_path" = x"no" ; then
3753                 AC_DEFINE(DISABLE_UTMPX)
3754         fi
3755 else
3756         AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
3757                 [Define if you want to specify the path to your utmpx file])
3758 fi
3759
3760 dnl wtmpx detection
3761 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
3762 AC_TRY_COMPILE([
3763 #include <sys/types.h>
3764 #include <utmp.h>
3765 #ifdef HAVE_UTMPX_H
3766 #include <utmpx.h>
3767 #endif
3768 #ifdef HAVE_PATHS_H
3769 #  include <paths.h>
3770 #endif
3771         ],
3772         [ char *wtmpx = WTMPX_FILE; ],
3773         [ AC_MSG_RESULT(yes) ],
3774         [ AC_MSG_RESULT(no)
3775           system_wtmpx_path=no ]
3776 )
3777 if test -z "$conf_wtmpx_location"; then
3778         if test x"$system_wtmpx_path" = x"no" ; then
3779                 AC_DEFINE(DISABLE_WTMPX)
3780         fi
3781 else
3782         AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location",
3783                 [Define if you want to specify the path to your wtmpx file])
3784 fi
3785
3786
3787 if test ! -z "$blibpath" ; then
3788         LDFLAGS="$LDFLAGS $blibflags$blibpath"
3789         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
3790 fi
3791
3792 dnl remove pam and dl because they are in $LIBPAM
3793 if test "$PAM_MSG" = yes ; then
3794         LIBS=`echo $LIBS | sed 's/-lpam //'`
3795 fi
3796 if test "$ac_cv_lib_pam_pam_set_item" = yes ; then
3797         LIBS=`echo $LIBS | sed 's/-ldl //'`
3798 fi
3799
3800 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
3801 dnl Add now.
3802 CFLAGS="$CFLAGS $werror_flags"
3803
3804 AC_EXEEXT
3805 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openbsd-compat/Makefile \
3806         openbsd-compat/regress/Makefile scard/Makefile ssh_prng_cmds survey.sh])
3807 AC_OUTPUT
3808
3809 # Print summary of options
3810
3811 # Someone please show me a better way :)
3812 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
3813 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
3814 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
3815 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
3816 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
3817 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
3818 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
3819 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
3820 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
3821 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
3822
3823 echo ""
3824 echo "OpenSSH has been configured with the following options:"
3825 echo "                     User binaries: $B"
3826 echo "                   System binaries: $C"
3827 echo "               Configuration files: $D"
3828 echo "                   Askpass program: $E"
3829 echo "                      Manual pages: $F"
3830 echo "                          PID file: $G"
3831 echo "  Privilege separation chroot path: $H"
3832 if test "x$external_path_file" = "x/etc/login.conf" ; then
3833 echo "   At runtime, sshd will use the path defined in $external_path_file"
3834 echo "   Make sure the path to scp is present, otherwise scp will not work"
3835 else
3836 echo "            sshd default user PATH: $I"
3837         if test ! -z "$external_path_file"; then
3838 echo "   (If PATH is set in $external_path_file it will be used instead. If"
3839 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
3840         fi
3841 fi
3842 if test ! -z "$superuser_path" ; then
3843 echo "          sshd superuser user PATH: $J"
3844 fi
3845 echo "                    Manpage format: $MANTYPE"
3846 echo "                       PAM support: $PAM_MSG"
3847 echo "                 KerberosV support: $KRB5_MSG"
3848 echo "                   SELinux support: $SELINUX_MSG"
3849 echo "                 Smartcard support: $SCARD_MSG"
3850 echo "                     S/KEY support: $SKEY_MSG"
3851 echo "              TCP Wrappers support: $TCPW_MSG"
3852 echo "              MD5 password support: $MD5_MSG"
3853 echo "                   libedit support: $LIBEDIT_MSG"
3854 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
3855 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
3856 echo "                  BSD Auth support: $BSD_AUTH_MSG"
3857 echo "              Random number source: $RAND_MSG"
3858 if test ! -z "$USE_RAND_HELPER" ; then
3859 echo "     ssh-rand-helper collects from: $RAND_HELPER_MSG"
3860 fi
3861
3862 echo ""
3863
3864 echo "              Host: ${host}"
3865 echo "          Compiler: ${CC}"
3866 echo "    Compiler flags: ${CFLAGS}"
3867 echo "Preprocessor flags: ${CPPFLAGS}"
3868 echo "      Linker flags: ${LDFLAGS}"
3869 echo "         Libraries: ${LIBWRAP} ${LIBPAM} ${LIBS}"
3870
3871 echo ""
3872
3873 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
3874         echo "SVR4 style packages are supported with \"make package\""
3875         echo ""
3876 fi
3877
3878 if test "x$PAM_MSG" = "xyes" ; then
3879         echo "PAM is enabled. You may need to install a PAM control file "
3880         echo "for sshd, otherwise password authentication may fail. "
3881         echo "Example PAM control files can be found in the contrib/ "
3882         echo "subdirectory"
3883         echo ""
3884 fi
3885
3886 if test ! -z "$RAND_HELPER_CMDHASH" ; then
3887         echo "WARNING: you are using the builtin random number collection "
3888         echo "service. Please read WARNING.RNG and request that your OS "
3889         echo "vendor includes kernel-based random number collection in "
3890         echo "future versions of your OS."
3891         echo ""
3892 fi
3893
3894 if test ! -z "$NO_PEERCHECK" ; then
3895         echo "WARNING: the operating system that you are using does not "
3896         echo "appear to support either the getpeereid() API nor the "
3897         echo "SO_PEERCRED getsockopt() option. These facilities are used to "
3898         echo "enforce security checks to prevent unauthorised connections to "
3899         echo "ssh-agent. Their absence increases the risk that a malicious "
3900         echo "user can connect to your agent. "
3901         echo ""
3902 fi
3903
3904 if test "$AUDIT_MODULE" = "bsm" ; then
3905         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
3906         echo "See the Solaris section in README.platform for details."
3907 fi