configure.ac

   1 # $Id$
   2 #
   3 # Copyright (c) 1999-2004 Damien Miller
   4 #
   5 # Permission to use, copy, modify, and distribute this software for any
   6 # purpose with or without fee is hereby granted, provided that the above
   7 # copyright notice and this permission notice appear in all copies.
   8 #
   9 # THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  10 # WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  11 # MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  12 # ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  13 # WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14 # ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16
  17 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
  18 AC_REVISION($Revision$)
  19 AC_CONFIG_SRCDIR([ssh.c])
  20
  21 AC_CONFIG_HEADER(config.h)
  22 AC_PROG_CC
  23 AC_CANONICAL_HOST
  24 AC_C_BIGENDIAN
  25
  26 # Checks for programs.
  27 AC_PROG_AWK
  28 AC_PROG_CPP
  29 AC_PROG_RANLIB
  30 AC_PROG_INSTALL
  31 AC_PROG_EGREP
  32 AC_PATH_PROG(AR, ar)
  33 AC_PATH_PROG(CAT, cat)
  34 AC_PATH_PROG(KILL, kill)
  35 AC_PATH_PROGS(PERL, perl5 perl)
  36 AC_PATH_PROG(SED, sed)
  37 AC_SUBST(PERL)
  38 AC_PATH_PROG(ENT, ent)
  39 AC_SUBST(ENT)
  40 AC_PATH_PROG(TEST_MINUS_S_SH, bash)
  41 AC_PATH_PROG(TEST_MINUS_S_SH, ksh)
  42 AC_PATH_PROG(TEST_MINUS_S_SH, sh)
  43 AC_PATH_PROG(SH, sh)
  44 AC_SUBST(TEST_SHELL,sh)
  45
  46 dnl for buildpkg.sh
  47 AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd,
  48         [/usr/sbin${PATH_SEPARATOR}/etc])
  49 AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd,
  50         [/usr/sbin${PATH_SEPARATOR}/etc])
  51 AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no)
  52 if test -x /sbin/sh; then
  53         AC_SUBST(STARTUP_SCRIPT_SHELL,/sbin/sh)
  54 else
  55         AC_SUBST(STARTUP_SCRIPT_SHELL,/bin/sh)
  56 fi
  57
  58 # System features
  59 AC_SYS_LARGEFILE
  60
  61 if test -z "$AR" ; then
  62         AC_MSG_ERROR([*** 'ar' missing, please install or fix your \$PATH ***])
  63 fi
  64
  65 # Use LOGIN_PROGRAM from environment if possible
  66 if test ! -z "$LOGIN_PROGRAM" ; then
  67         AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM",
  68                 [If your header files don't define LOGIN_PROGRAM,
  69                 then use this (detected) from environment and PATH])
  70 else
  71         # Search for login
  72         AC_PATH_PROG(LOGIN_PROGRAM_FALLBACK, login)
  73         if test ! -z "$LOGIN_PROGRAM_FALLBACK" ; then
  74                 AC_DEFINE_UNQUOTED(LOGIN_PROGRAM_FALLBACK, "$LOGIN_PROGRAM_FALLBACK")
  75         fi
  76 fi
  77
  78 AC_PATH_PROG(PATH_PASSWD_PROG, passwd)
  79 if test ! -z "$PATH_PASSWD_PROG" ; then
  80         AC_DEFINE_UNQUOTED(_PATH_PASSWD_PROG, "$PATH_PASSWD_PROG",
  81                 [Full path of your "passwd" program])
  82 fi
  83
  84 if test -z "$LD" ; then
  85         LD=$CC
  86 fi
  87 AC_SUBST(LD)
  88
  89 AC_C_INLINE
  90
  91 AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
  92
  93 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
  94         CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
  95         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
  96         case $GCC_VER in
  97                 1.*) ;;
  98                 2.8* | 2.9*) CFLAGS="$CFLAGS -Wsign-compare" ;;
  99                 2.*) ;;
 100                 3.*) CFLAGS="$CFLAGS -Wsign-compare" ;;
 101                 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;;
 102                 *) ;;
 103         esac
 104
 105         if test -z "$have_llong_max"; then
 106                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
 107                 unset ac_cv_have_decl_LLONG_MAX
 108                 saved_CFLAGS="$CFLAGS"
 109                 CFLAGS="$CFLAGS -std=gnu99"
 110                 AC_CHECK_DECL(LLONG_MAX,
 111                     [have_llong_max=1],
 112                     [CFLAGS="$saved_CFLAGS"],
 113                     [#include <limits.h>]
 114                 )
 115         fi
 116 fi
 117
 118 AC_ARG_WITH(rpath,
 119         [  --without-rpath         Disable auto-added -R linker paths],
 120         [
 121                 if test "x$withval" = "xno" ; then
 122                         need_dash_r=""
 123                 fi
 124                 if test "x$withval" = "xyes" ; then
 125                         need_dash_r=1
 126                 fi
 127         ]
 128 )
 129
 130 # Check for some target-specific stuff
 131 case "$host" in
 132 *-*-aix*)
 133         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
 134         if (test -z "$blibpath"); then
 135                 blibpath="/usr/lib:/lib"
 136         fi
 137         saved_LDFLAGS="$LDFLAGS"
 138         for tryflags in -blibpath: -Wl,-blibpath: -Wl,-rpath, ;do
 139                 if (test -z "$blibflags"); then
 140                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
 141                         AC_TRY_LINK([], [], [blibflags=$tryflags])
 142                 fi
 143         done
 144         if (test -z "$blibflags"); then
 145                 AC_MSG_RESULT(not found)
 146                 AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
 147         else
 148                 AC_MSG_RESULT($blibflags)
 149         fi
 150         LDFLAGS="$saved_LDFLAGS"
 151         dnl Check for authenticate.  Might be in libs.a on older AIXes
 152         AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE, 1,
 153                 [Define if you want to enable AIX4's authenticate function])],
 154                 [AC_CHECK_LIB(s,authenticate,
 155                         [ AC_DEFINE(WITH_AIXAUTHENTICATE)
 156                                 LIBS="$LIBS -ls"
 157                         ])
 158                 ])
 159         dnl Check for various auth function declarations in headers.
 160         AC_CHECK_DECLS([authenticate, loginrestrictions, loginsuccess,
 161             passwdexpired, setauthdb], , , [#include <usersec.h>])
 162         dnl Check if loginfailed is declared and takes 4 arguments (AIX >= 5.2)
 163         AC_CHECK_DECLS(loginfailed,
 164                  [AC_MSG_CHECKING(if loginfailed takes 4 arguments)
 165                   AC_TRY_COMPILE(
 166                         [#include <usersec.h>],
 167                         [(void)loginfailed("user","host","tty",0);],
 168                         [AC_MSG_RESULT(yes)
 169                          AC_DEFINE(AIX_LOGINFAILED_4ARG, 1,
 170                                 [Define if your AIX loginfailed() function
 171                                 takes 4 arguments (AIX >= 5.2)])],
 172                         [AC_MSG_RESULT(no)]
 173                 )],
 174                 [],
 175                 [#include <usersec.h>]
 176         )
 177         AC_CHECK_FUNCS(setauthdb)
 178         check_for_aix_broken_getaddrinfo=1
 179         AC_DEFINE(BROKEN_REALPATH, 1, [Define if you have a broken realpath.])
 180         AC_DEFINE(SETEUID_BREAKS_SETUID, 1,
 181             [Define if your platform breaks doing a seteuid before a setuid])
 182         AC_DEFINE(BROKEN_SETREUID, 1, [Define if your setreuid() is broken])
 183         AC_DEFINE(BROKEN_SETREGID, 1, [Define if your setregid() is broken])
 184         dnl AIX handles lastlog as part of its login message
 185         AC_DEFINE(DISABLE_LASTLOG, 1, [Define if you don't want to use lastlog])
 186         AC_DEFINE(LOGIN_NEEDS_UTMPX, 1,
 187                 [Some systems need a utmpx entry for /bin/login to work])
 188         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV,
 189                 [Define to a Set Process Title type if your system is
 190                 supported by bsd-setproctitle.c])
 191         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 192             [AIX 5.2 and 5.3 (and presumably newer) require this])
 193         ;;
 194 *-*-cygwin*)
 195         check_for_libcrypt_later=1
 196         LIBS="$LIBS /usr/lib/textmode.o"
 197         AC_DEFINE(HAVE_CYGWIN, 1, [Define if you are on Cygwin])
 198         AC_DEFINE(USE_PIPES, 1, [Use PIPES instead of a socketpair()])
 199         AC_DEFINE(DISABLE_SHADOW, 1,
 200                 [Define if you want to disable shadow passwords])
 201         AC_DEFINE(IP_TOS_IS_BROKEN, 1,
 202                 [Define if your system choked on IP TOS setting])
 203         AC_DEFINE(NO_X11_UNIX_SOCKETS, 1,
 204                 [Define if X11 doesn't support AF_UNIX sockets on that system])
 205         AC_DEFINE(NO_IPPORT_RESERVED_CONCEPT, 1,
 206                 [Define if the concept of ports only accessible to
 207                 superusers isn't known])
 208         AC_DEFINE(DISABLE_FD_PASSING, 1,
 209                 [Define if your platform needs to skip post auth
 210                 file descriptor passing])
 211         ;;
 212 *-*-dgux*)
 213         AC_DEFINE(IP_TOS_IS_BROKEN)
 214         AC_DEFINE(SETEUID_BREAKS_SETUID)
 215         AC_DEFINE(BROKEN_SETREUID)
 216         AC_DEFINE(BROKEN_SETREGID)
 217         ;;
 218 *-*-darwin*)
 219         AC_MSG_CHECKING(if we have working getaddrinfo)
 220         AC_TRY_RUN([#include <mach-o/dyld.h>
 221 main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 222                 exit(0);
 223         else
 224                 exit(1);
 225 }], [AC_MSG_RESULT(working)],
 226         [AC_MSG_RESULT(buggy)
 227         AC_DEFINE(BROKEN_GETADDRINFO, 1, [getaddrinfo is broken (if present)])],
 228         [AC_MSG_RESULT(assume it is working)])
 229         AC_DEFINE(SETEUID_BREAKS_SETUID)
 230         AC_DEFINE(BROKEN_SETREUID)
 231         AC_DEFINE(BROKEN_SETREGID)
 232         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
 233                 [Define if your resolver libs need this for getrrsetbyname])
 234         ;;
 235 *-*-hpux*)
 236         # first we define all of the options common to all HP-UX releases
 237         CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
 238         IPADDR_IN_DISPLAY=yes
 239         AC_DEFINE(USE_PIPES)
 240         AC_DEFINE(LOGIN_NO_ENDOPT, 1,
 241             [Define if your login program cannot handle end of options ("--")])
 242         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 243         AC_DEFINE(LOCKED_PASSWD_STRING, "*",
 244                 [String used in /etc/passwd to denote locked account])
 245         AC_DEFINE(SPT_TYPE,SPT_PSTAT)
 246         MAIL="/var/mail/username"
 247         LIBS="$LIBS -lsec"
 248         AC_CHECK_LIB(xnet, t_error, ,
 249             AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
 250
 251         # next, we define all of the options specific to major releases
 252         case "$host" in
 253         *-*-hpux10*)
 254                 if test -z "$GCC"; then
 255                         CFLAGS="$CFLAGS -Ae"
 256                 fi
 257                 ;;
 258         *-*-hpux11*)
 259                 AC_DEFINE(PAM_SUN_CODEBASE, 1,
 260                         [Define if you are using Solaris-derived PAM which
 261                         passes pam_messages to the conversation function
 262                         with an extra level of indirection])
 263                 AC_DEFINE(DISABLE_UTMP, 1,
 264                         [Define if you don't want to use utmp])
 265                 AC_DEFINE(USE_BTMP, 1, [Use btmp to log bad logins])
 266                 check_for_hpux_broken_getaddrinfo=1
 267                 check_for_conflicting_getspnam=1
 268                 ;;
 269         esac
 270
 271         # lastly, we define options specific to minor releases
 272         case "$host" in
 273         *-*-hpux10.26)
 274                 AC_DEFINE(HAVE_SECUREWARE, 1,
 275                         [Define if you have SecureWare-based
 276                         protected password database])
 277                 disable_ptmx_check=yes
 278                 LIBS="$LIBS -lsecpw"
 279                 ;;
 280         esac
 281         ;;
 282 *-*-irix5*)
 283         PATH="$PATH:/usr/etc"
 284         AC_DEFINE(BROKEN_INET_NTOA, 1,
 285                 [Define if you system's inet_ntoa is busted
 286                 (e.g. Irix gcc issue)])
 287         AC_DEFINE(SETEUID_BREAKS_SETUID)
 288         AC_DEFINE(BROKEN_SETREUID)
 289         AC_DEFINE(BROKEN_SETREGID)
 290         AC_DEFINE(WITH_ABBREV_NO_TTY, 1,
 291                 [Define if you shouldn't strip 'tty' from your
 292                 ttyname in [uw]tmp])
 293         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 294         ;;
 295 *-*-irix6*)
 296         PATH="$PATH:/usr/etc"
 297         AC_DEFINE(WITH_IRIX_ARRAY, 1,
 298                 [Define if you have/want arrays
 299                 (cluster-wide session managment, not C arrays)])
 300         AC_DEFINE(WITH_IRIX_PROJECT, 1,
 301                 [Define if you want IRIX project management])
 302         AC_DEFINE(WITH_IRIX_AUDIT, 1,
 303                 [Define if you want IRIX audit trails])
 304         AC_CHECK_FUNC(jlimit_startjob, [AC_DEFINE(WITH_IRIX_JOBS, 1,
 305                 [Define if you want IRIX kernel jobs])])
 306         AC_DEFINE(BROKEN_INET_NTOA)
 307         AC_DEFINE(SETEUID_BREAKS_SETUID)
 308         AC_DEFINE(BROKEN_SETREUID)
 309         AC_DEFINE(BROKEN_SETREGID)
 310         AC_DEFINE(BROKEN_UPDWTMPX, 1, [updwtmpx is broken (if present)])
 311         AC_DEFINE(WITH_ABBREV_NO_TTY)
 312         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 313         ;;
 314 *-*-linux*)
 315         no_dev_ptmx=1
 316         check_for_libcrypt_later=1
 317         check_for_openpty_ctty_bug=1
 318         AC_DEFINE(DONT_TRY_OTHER_AF, 1, [Workaround more Linux IPv6 quirks])
 319         AC_DEFINE(PAM_TTY_KLUDGE, 1,
 320                 [Work around problematic Linux PAM modules handling of PAM_TTY])
 321         AC_DEFINE(LOCKED_PASSWD_PREFIX, "!",
 322                 [String used in /etc/passwd to denote locked account])
 323         AC_DEFINE(SPT_TYPE,SPT_REUSEARGV)
 324         AC_DEFINE(LINK_OPNOTSUPP_ERRNO, EPERM,
 325                 [Define to whatever link() returns for "not supported"
 326                 if it doesn't return EOPNOTSUPP.])
 327         AC_DEFINE(_PATH_BTMP, "/var/log/btmp", [log for bad login attempts])
 328         AC_DEFINE(USE_BTMP)
 329         inet6_default_4in6=yes
 330         case `uname -r` in
 331         1.*|2.0.*)
 332                 AC_DEFINE(BROKEN_CMSG_TYPE, 1,
 333                         [Define if cmsg_type is not passed correctly])
 334                 ;;
 335         esac
 336         # tun(4) forwarding compat code
 337         AC_CHECK_HEADERS(linux/if_tun.h)
 338         if test "x$ac_cv_header_linux_if_tun_h" = "xyes" ; then
 339                 AC_DEFINE(SSH_TUN_LINUX, 1,
 340                     [Open tunnel devices the Linux tun/tap way])
 341                 AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
 342                     [Use tunnel device compatibility to OpenBSD])
 343                 AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 344                     [Prepend the address family to IP tunnel traffic])
 345         fi
 346         ;;
 347 mips-sony-bsd|mips-sony-newsos4)
 348         AC_DEFINE(NEED_SETPGRP, 1, [Need setpgrp to acquire controlling tty])
 349         SONY=1
 350         ;;
 351 *-*-netbsd*)
 352         check_for_libcrypt_before=1
 353         if test "x$withval" != "xno" ; then
 354                 need_dash_r=1
 355         fi
 356         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 357         AC_CHECK_HEADER([net/if_tap.h], ,
 358             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 359         AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
 360             [Prepend the address family to IP tunnel traffic])
 361         ;;
 362 *-*-freebsd*)
 363         check_for_libcrypt_later=1
 364         AC_DEFINE(LOCKED_PASSWD_PREFIX, "*LOCKED*", [Account locked with pw(1)])
 365         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
 366         AC_CHECK_HEADER([net/if_tap.h], ,
 367             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
 368         ;;
 369 *-*-bsdi*)
 370         AC_DEFINE(SETEUID_BREAKS_SETUID)
 371         AC_DEFINE(BROKEN_SETREUID)
 372         AC_DEFINE(BROKEN_SETREGID)
 373         ;;
 374 *-next-*)
 375         conf_lastlog_location="/usr/adm/lastlog"
 376         conf_utmp_location=/etc/utmp
 377         conf_wtmp_location=/usr/adm/wtmp
 378         MAIL=/usr/spool/mail
 379         AC_DEFINE(HAVE_NEXT, 1, [Define if you are on NeXT])
 380         AC_DEFINE(BROKEN_REALPATH)
 381         AC_DEFINE(USE_PIPES)
 382         AC_DEFINE(BROKEN_SAVED_UIDS, 1, [Needed for NeXT])
 383         ;;
 384 *-*-openbsd*)
 385         AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
 386         AC_DEFINE(HAVE_ATTRIBUTE__BOUNDED__, 1, [OpenBSD's gcc has bounded])
 387         AC_DEFINE(SSH_TUN_OPENBSD, 1, [Open tunnel devices the OpenBSD way])
 388         ;;
 389 *-*-solaris*)
 390         if test "x$withval" != "xno" ; then
 391                 need_dash_r=1
 392         fi
 393         AC_DEFINE(PAM_SUN_CODEBASE)
 394         AC_DEFINE(LOGIN_NEEDS_UTMPX)
 395         AC_DEFINE(LOGIN_NEEDS_TERM, 1,
 396                 [Some versions of /bin/login need the TERM supplied
 397                 on the commandline])
 398         AC_DEFINE(PAM_TTY_KLUDGE)
 399         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
 400                 [Define if pam_chauthtok wants real uid set
 401                 to the unpriv'ed user])
 402         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 403         # Pushing STREAMS modules will cause sshd to acquire a controlling tty.
 404         AC_DEFINE(SSHD_ACQUIRES_CTTY, 1,
 405                 [Define if sshd somehow reacquires a controlling TTY
 406                 after setsid()])
 407         external_path_file=/etc/default/login
 408         # hardwire lastlog location (can't detect it on some versions)
 409         conf_lastlog_location="/var/adm/lastlog"
 410         AC_MSG_CHECKING(for obsolete utmp and wtmp in solaris2.x)
 411         sol2ver=`echo "$host"| sed -e 's/.*[[0-9]]\.//'`
 412         if test "$sol2ver" -ge 8; then
 413                 AC_MSG_RESULT(yes)
 414                 AC_DEFINE(DISABLE_UTMP)
 415                 AC_DEFINE(DISABLE_WTMP, 1,
 416                         [Define if you don't want to use wtmp])
 417         else
 418                 AC_MSG_RESULT(no)
 419         fi
 420         ;;
 421 *-*-sunos4*)
 422         CPPFLAGS="$CPPFLAGS -DSUNOS4"
 423         AC_CHECK_FUNCS(getpwanam)
 424         AC_DEFINE(PAM_SUN_CODEBASE)
 425         conf_utmp_location=/etc/utmp
 426         conf_wtmp_location=/var/adm/wtmp
 427         conf_lastlog_location=/var/adm/lastlog
 428         AC_DEFINE(USE_PIPES)
 429         ;;
 430 *-ncr-sysv*)
 431         LIBS="$LIBS -lc89"
 432         AC_DEFINE(USE_PIPES)
 433         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 434         AC_DEFINE(SETEUID_BREAKS_SETUID)
 435         AC_DEFINE(BROKEN_SETREUID)
 436         AC_DEFINE(BROKEN_SETREGID)
 437         ;;
 438 *-sni-sysv*)
 439         # /usr/ucblib MUST NOT be searched on ReliantUNIX
 440         AC_CHECK_LIB(dl, dlsym, ,)
 441         # -lresolv needs to be at the end of LIBS or DNS lookups break
 442         AC_CHECK_LIB(resolv, res_query, [ LIBS="$LIBS -lresolv" ])
 443         IPADDR_IN_DISPLAY=yes
 444         AC_DEFINE(USE_PIPES)
 445         AC_DEFINE(IP_TOS_IS_BROKEN)
 446         AC_DEFINE(SETEUID_BREAKS_SETUID)
 447         AC_DEFINE(BROKEN_SETREUID)
 448         AC_DEFINE(BROKEN_SETREGID)
 449         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 450         external_path_file=/etc/default/login
 451         # /usr/ucblib/libucb.a no longer needed on ReliantUNIX
 452         # Attention: always take care to bind libsocket and libnsl before libc,
 453         # otherwise you will find lots of "SIOCGPGRP errno 22" on syslog
 454         ;;
 455 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 456 *-*-sysv4.2*)
 457         CFLAGS="$CFLAGS -Dva_list=_VA_LIST"
 458         AC_DEFINE(USE_PIPES)
 459         AC_DEFINE(SETEUID_BREAKS_SETUID)
 460         AC_DEFINE(BROKEN_SETREUID)
 461         AC_DEFINE(BROKEN_SETREGID)
 462         AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd])
 463         AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 464         ;;
 465 # UnixWare 7.x, OpenUNIX 8
 466 *-*-sysv5*)
 467         check_for_libcrypt_later=1
 468         AC_DEFINE(UNIXWARE_LONG_PASSWORDS, 1, [Support passwords > 8 chars])
 469         AC_DEFINE(USE_PIPES)
 470         AC_DEFINE(SETEUID_BREAKS_SETUID)
 471         AC_DEFINE(BROKEN_SETREUID)
 472         AC_DEFINE(BROKEN_SETREGID)
 473         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 474         case "$host" in
 475         *-*-sysv5SCO_SV*)       # SCO OpenServer 6.x
 476                 TEST_SHELL=/u95/bin/sh
 477                 AC_DEFINE(BROKEN_LIBIAF, 1,
 478                         [ia_uinfo routines not supported by OS yet])
 479                 ;;
 480         *)      AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
 481                 ;;
 482         esac
 483         ;;
 484 *-*-sysv*)
 485         ;;
 486 # SCO UNIX and OEM versions of SCO UNIX
 487 *-*-sco3.2v4*)
 488         AC_MSG_ERROR("This Platform is no longer supported.")
 489         ;;
 490 # SCO OpenServer 5.x
 491 *-*-sco3.2v5*)
 492         if test -z "$GCC"; then
 493                 CFLAGS="$CFLAGS -belf"
 494         fi
 495         LIBS="$LIBS -lprot -lx -ltinfo -lm"
 496         no_dev_ptmx=1
 497         AC_DEFINE(USE_PIPES)
 498         AC_DEFINE(HAVE_SECUREWARE)
 499         AC_DEFINE(DISABLE_SHADOW)
 500         AC_DEFINE(DISABLE_FD_PASSING)
 501         AC_DEFINE(SETEUID_BREAKS_SETUID)
 502         AC_DEFINE(BROKEN_SETREUID)
 503         AC_DEFINE(BROKEN_SETREGID)
 504         AC_DEFINE(WITH_ABBREV_NO_TTY)
 505         AC_DEFINE(BROKEN_UPDWTMPX)
 506         AC_DEFINE(PASSWD_NEEDS_USERNAME)
 507         AC_CHECK_FUNCS(getluid setluid)
 508         MANTYPE=man
 509         TEST_SHELL=ksh
 510         ;;
 511 *-*-unicosmk*)
 512         AC_DEFINE(NO_SSH_LASTLOG, 1,
 513                 [Define if you don't want to use lastlog in session.c])
 514         AC_DEFINE(SETEUID_BREAKS_SETUID)
 515         AC_DEFINE(BROKEN_SETREUID)
 516         AC_DEFINE(BROKEN_SETREGID)
 517         AC_DEFINE(USE_PIPES)
 518         AC_DEFINE(DISABLE_FD_PASSING)
 519         LDFLAGS="$LDFLAGS"
 520         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 521         MANTYPE=cat
 522         ;;
 523 *-*-unicosmp*)
 524         AC_DEFINE(SETEUID_BREAKS_SETUID)
 525         AC_DEFINE(BROKEN_SETREUID)
 526         AC_DEFINE(BROKEN_SETREGID)
 527         AC_DEFINE(WITH_ABBREV_NO_TTY)
 528         AC_DEFINE(USE_PIPES)
 529         AC_DEFINE(DISABLE_FD_PASSING)
 530         LDFLAGS="$LDFLAGS"
 531         LIBS="$LIBS -lgen -lacid -ldb"
 532         MANTYPE=cat
 533         ;;
 534 *-*-unicos*)
 535         AC_DEFINE(SETEUID_BREAKS_SETUID)
 536         AC_DEFINE(BROKEN_SETREUID)
 537         AC_DEFINE(BROKEN_SETREGID)
 538         AC_DEFINE(USE_PIPES)
 539         AC_DEFINE(DISABLE_FD_PASSING)
 540         AC_DEFINE(NO_SSH_LASTLOG)
 541         LDFLAGS="$LDFLAGS -Wl,-Dmsglevel=334:fatal"
 542         LIBS="$LIBS -lgen -lrsc -lshare -luex -lacm"
 543         MANTYPE=cat
 544         ;;
 545 *-dec-osf*)
 546         AC_MSG_CHECKING(for Digital Unix SIA)
 547         no_osfsia=""
 548         AC_ARG_WITH(osfsia,
 549                 [  --with-osfsia           Enable Digital Unix SIA],
 550                 [
 551                         if test "x$withval" = "xno" ; then
 552                                 AC_MSG_RESULT(disabled)
 553                                 no_osfsia=1
 554                         fi
 555                 ],
 556         )
 557         if test -z "$no_osfsia" ; then
 558                 if test -f /etc/sia/matrix.conf; then
 559                         AC_MSG_RESULT(yes)
 560                         AC_DEFINE(HAVE_OSF_SIA, 1,
 561                                 [Define if you have Digital Unix Security
 562                                 Integration Architecture])
 563                         AC_DEFINE(DISABLE_LOGIN, 1,
 564                                 [Define if you don't want to use your
 565                                 system's login() call])
 566                         AC_DEFINE(DISABLE_FD_PASSING)
 567                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
 568                 else
 569                         AC_MSG_RESULT(no)
 570                         AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin",
 571                           [String used in /etc/passwd to denote locked account])
 572                 fi
 573         fi
 574         AC_DEFINE(BROKEN_GETADDRINFO)
 575         AC_DEFINE(SETEUID_BREAKS_SETUID)
 576         AC_DEFINE(BROKEN_SETREUID)
 577         AC_DEFINE(BROKEN_SETREGID)
 578         ;;
 579
 580 *-*-nto-qnx*)
 581         AC_DEFINE(USE_PIPES)
 582         AC_DEFINE(NO_X11_UNIX_SOCKETS)
 583         AC_DEFINE(MISSING_NFDBITS, 1, [Define on *nto-qnx systems])
 584         AC_DEFINE(MISSING_HOWMANY, 1, [Define on *nto-qnx systems])
 585         AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
 586         AC_DEFINE(DISABLE_LASTLOG)
 587         AC_DEFINE(SSHD_ACQUIRES_CTTY)
 588         enable_etc_default_login=no     # has incompatible /etc/default/login
 589         ;;
 590
 591 *-*-ultrix*)
 592         AC_DEFINE(BROKEN_GETGROUPS, 1, [getgroups(0,NULL) will return -1])
 593         AC_DEFINE(BROKEN_MMAP, 1, [Ultrix mmap can't map files])
 594         AC_DEFINE(NEED_SETPGRP)
 595         AC_DEFINE(HAVE_SYS_SYSLOG_H, 1, [Force use of sys/syslog.h on Ultrix])
 596         ;;
 597
 598 *-*-lynxos)
 599         CFLAGS="$CFLAGS -D__NO_INCLUDE_WARN__"
 600         AC_DEFINE(MISSING_HOWMANY)
 601         AC_DEFINE(BROKEN_SETVBUF, 1, [LynxOS has broken setvbuf() implementation])
 602         ;;
 603 esac
 604
 605 # Allow user to specify flags
 606 AC_ARG_WITH(cflags,
 607         [  --with-cflags           Specify additional flags to pass to compiler],
 608         [
 609                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 610                     test "x${withval}" != "xyes"; then
 611                         CFLAGS="$CFLAGS $withval"
 612                 fi
 613         ]
 614 )
 615 AC_ARG_WITH(cppflags,
 616         [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
 617         [
 618                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 619                     test "x${withval}" != "xyes"; then
 620                         CPPFLAGS="$CPPFLAGS $withval"
 621                 fi
 622         ]
 623 )
 624 AC_ARG_WITH(ldflags,
 625         [  --with-ldflags          Specify additional flags to pass to linker],
 626         [
 627                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 628                     test "x${withval}" != "xyes"; then
 629                         LDFLAGS="$LDFLAGS $withval"
 630                 fi
 631         ]
 632 )
 633 AC_ARG_WITH(libs,
 634         [  --with-libs             Specify additional libraries to link with],
 635         [
 636                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
 637                     test "x${withval}" != "xyes"; then
 638                         LIBS="$LIBS $withval"
 639                 fi
 640         ]
 641 )
 642 AC_ARG_WITH(Werror,
 643         [  --with-Werror           Build main code with -Werror],
 644         [
 645                 if test -n "$withval"  &&  test "x$withval" != "xno"; then
 646                         werror_flags="-Werror"
 647                         if test "x${withval}" != "xyes"; then
 648                                 werror_flags="$withval"
 649                         fi
 650                 fi
 651         ]
 652 )
 653
 654 AC_MSG_CHECKING(compiler and flags for sanity)
 655 AC_RUN_IFELSE(
 656         [AC_LANG_SOURCE([
 657 #include <stdio.h>
 658 int main(){exit(0);}
 659         ])],
 660         [       AC_MSG_RESULT(yes) ],
 661         [
 662                 AC_MSG_RESULT(no)
 663                 AC_MSG_ERROR([*** compiler cannot create working executables, check config.log ***])
 664         ],
 665         [       AC_MSG_WARN([cross compiling: not checking compiler sanity]) ]
 666 )
 667
 668 dnl Checks for header files.
 669 AC_CHECK_HEADERS( \
 670         bstring.h \
 671         crypt.h \
 672         crypto/sha2.h \
 673         dirent.h \
 674         endian.h \
 675         features.h \
 676         floatingpoint.h \
 677         getopt.h \
 678         glob.h \
 679         ia.h \
 680         iaf.h \
 681         limits.h \
 682         login.h \
 683         maillock.h \
 684         ndir.h \
 685         netdb.h \
 686         netgroup.h \
 687         pam/pam_appl.h \
 688         paths.h \
 689         pty.h \
 690         readpassphrase.h \
 691         rpc/types.h \
 692         security/pam_appl.h \
 693         sha2.h \
 694         shadow.h \
 695         stddef.h \
 696         stdint.h \
 697         string.h \
 698         strings.h \
 699         sys/audit.h \
 700         sys/bitypes.h \
 701         sys/bsdtty.h \
 702         sys/cdefs.h \
 703         sys/dir.h \
 704         sys/mman.h \
 705         sys/ndir.h \
 706         sys/prctl.h \
 707         sys/pstat.h \
 708         sys/select.h \
 709         sys/stat.h \
 710         sys/stream.h \
 711         sys/stropts.h \
 712         sys/strtio.h \
 713         sys/sysmacros.h \
 714         sys/time.h \
 715         sys/timers.h \
 716         sys/un.h \
 717         time.h \
 718         tmpdir.h \
 719         ttyent.h \
 720         unistd.h \
 721         usersec.h \
 722         util.h \
 723         utime.h \
 724         utmp.h \
 725         utmpx.h \
 726         vis.h \
 727 )
 728
 729 # lastlog.h requires sys/time.h to be included first on Solaris
 730 AC_CHECK_HEADERS(lastlog.h, [], [], [
 731 #ifdef HAVE_SYS_TIME_H
 732 # include <sys/time.h>
 733 #endif
 734 ])
 735
 736 # sys/ptms.h requires sys/stream.h to be included first on Solaris
 737 AC_CHECK_HEADERS(sys/ptms.h, [], [], [
 738 #ifdef HAVE_SYS_STREAM_H
 739 # include <sys/stream.h>
 740 #endif
 741 ])
 742
 743 # login_cap.h requires sys/types.h on NetBSD
 744 AC_CHECK_HEADERS(login_cap.h, [], [], [
 745 #include <sys/types.h>
 746 ])
 747
 748 # Checks for libraries.
 749 AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
 750 AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt))
 751
 752 dnl IRIX and Solaris 2.5.1 have dirname() in libgen
 753 AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
 754         AC_CHECK_LIB(gen, dirname,[
 755                 AC_CACHE_CHECK([for broken dirname],
 756                         ac_cv_have_broken_dirname, [
 757                         save_LIBS="$LIBS"
 758                         LIBS="$LIBS -lgen"
 759                         AC_RUN_IFELSE(
 760                                 [AC_LANG_SOURCE([[
 761 #include <libgen.h>
 762 #include <string.h>
 763
 764 int main(int argc, char **argv) {
 765     char *s, buf[32];
 766
 767     strncpy(buf,"/etc", 32);
 768     s = dirname(buf);
 769     if (!s || strncmp(s, "/", 32) != 0) {
 770         exit(1);
 771     } else {
 772         exit(0);
 773     }
 774 }
 775                                 ]])],
 776                                 [ ac_cv_have_broken_dirname="no" ],
 777                                 [ ac_cv_have_broken_dirname="yes" ],
 778                                 [ ac_cv_have_broken_dirname="no" ],
 779                         )
 780                         LIBS="$save_LIBS"
 781                 ])
 782                 if test "x$ac_cv_have_broken_dirname" = "xno" ; then
 783                         LIBS="$LIBS -lgen"
 784                         AC_DEFINE(HAVE_DIRNAME)
 785                         AC_CHECK_HEADERS(libgen.h)
 786                 fi
 787         ])
 788 ])
 789
 790 AC_CHECK_FUNC(getspnam, ,
 791         AC_CHECK_LIB(gen, getspnam, LIBS="$LIBS -lgen"))
 792 AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME, 1,
 793         [Define if you have the basename function.]))
 794
 795 dnl zlib is required
 796 AC_ARG_WITH(zlib,
 797         [  --with-zlib=PATH        Use zlib in PATH],
 798         [ if test "x$withval" = "xno" ; then
 799                 AC_MSG_ERROR([*** zlib is required ***])
 800           elif test "x$withval" != "xyes"; then
 801                 if test -d "$withval/lib"; then
 802                         if test -n "${need_dash_r}"; then
 803                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
 804                         else
 805                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
 806                         fi
 807                 else
 808                         if test -n "${need_dash_r}"; then
 809                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
 810                         else
 811                                 LDFLAGS="-L${withval} ${LDFLAGS}"
 812                         fi
 813                 fi
 814                 if test -d "$withval/include"; then
 815                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
 816                 else
 817                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
 818                 fi
 819         fi ]
 820 )
 821
 822 AC_CHECK_LIB(z, deflate, ,
 823         [
 824                 saved_CPPFLAGS="$CPPFLAGS"
 825                 saved_LDFLAGS="$LDFLAGS"
 826                 save_LIBS="$LIBS"
 827                 dnl Check default zlib install dir
 828                 if test -n "${need_dash_r}"; then
 829                         LDFLAGS="-L/usr/local/lib -R/usr/local/lib ${saved_LDFLAGS}"
 830                 else
 831                         LDFLAGS="-L/usr/local/lib ${saved_LDFLAGS}"
 832                 fi
 833                 CPPFLAGS="-I/usr/local/include ${saved_CPPFLAGS}"
 834                 LIBS="$LIBS -lz"
 835                 AC_TRY_LINK_FUNC(deflate, AC_DEFINE(HAVE_LIBZ),
 836                         [
 837                                 AC_MSG_ERROR([*** zlib missing - please install first or check config.log ***])
 838                         ]
 839                 )
 840         ]
 841 )
 842 AC_CHECK_HEADER([zlib.h], ,AC_MSG_ERROR([*** zlib.h missing - please install first or check config.log ***]))
 843
 844 AC_ARG_WITH(zlib-version-check,
 845         [  --without-zlib-version-check Disable zlib version check],
 846         [  if test "x$withval" = "xno" ; then
 847                 zlib_check_nonfatal=1
 848            fi
 849         ]
 850 )
 851
 852 AC_MSG_CHECKING(for possibly buggy zlib)
 853 AC_RUN_IFELSE([AC_LANG_SOURCE([[
 854 #include <stdio.h>
 855 #include <zlib.h>
 856 int main()
 857 {
 858         int a=0, b=0, c=0, d=0, n, v;
 859         n = sscanf(ZLIB_VERSION, "%d.%d.%d.%d", &a, &b, &c, &d);
 860         if (n != 3 && n != 4)
 861                 exit(1);
 862         v = a*1000000 + b*10000 + c*100 + d;
 863         fprintf(stderr, "found zlib version %s (%d)\n", ZLIB_VERSION, v);
 864
 865         /* 1.1.4 is OK */
 866         if (a == 1 && b == 1 && c >= 4)
 867                 exit(0);
 868
 869         /* 1.2.3 and up are OK */
 870         if (v >= 1020300)
 871                 exit(0);
 872
 873         exit(2);
 874 }
 875         ]])],
 876         AC_MSG_RESULT(no),
 877         [ AC_MSG_RESULT(yes)
 878           if test -z "$zlib_check_nonfatal" ; then
 879                 AC_MSG_ERROR([*** zlib too old - check config.log ***
 880 Your reported zlib version has known security problems.  It's possible your
 881 vendor has fixed these problems without changing the version number.  If you
 882 are sure this is the case, you can disable the check by running
 883 "./configure --without-zlib-version-check".
 884 If you are in doubt, upgrade zlib to version 1.2.3 or greater.
 885 See http://www.gzip.org/zlib/ for details.])
 886           else
 887                 AC_MSG_WARN([zlib version may have security problems])
 888           fi
 889         ],
 890         [       AC_MSG_WARN([cross compiling: not checking zlib version]) ]
 891 )
 892
 893 dnl UnixWare 2.x
 894 AC_CHECK_FUNC(strcasecmp,
 895         [], [ AC_CHECK_LIB(resolv, strcasecmp, LIBS="$LIBS -lresolv") ]
 896 )
 897 AC_CHECK_FUNCS(utimes,
 898         [], [ AC_CHECK_LIB(c89, utimes, [AC_DEFINE(HAVE_UTIMES)
 899                                         LIBS="$LIBS -lc89"]) ]
 900 )
 901
 902 dnl    Checks for libutil functions
 903 AC_CHECK_HEADERS(libutil.h)
 904 AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1,
 905         [Define if your libraries define login()])])
 906 AC_CHECK_FUNCS(logout updwtmp logwtmp)
 907
 908 AC_FUNC_STRFTIME
 909
 910 # Check for ALTDIRFUNC glob() extension
 911 AC_MSG_CHECKING(for GLOB_ALTDIRFUNC support)
 912 AC_EGREP_CPP(FOUNDIT,
 913         [
 914                 #include <glob.h>
 915                 #ifdef GLOB_ALTDIRFUNC
 916                 FOUNDIT
 917                 #endif
 918         ],
 919         [
 920                 AC_DEFINE(GLOB_HAS_ALTDIRFUNC, 1,
 921                         [Define if your system glob() function has
 922                         the GLOB_ALTDIRFUNC extension])
 923                 AC_MSG_RESULT(yes)
 924         ],
 925         [
 926                 AC_MSG_RESULT(no)
 927         ]
 928 )
 929
 930 # Check for g.gl_matchc glob() extension
 931 AC_MSG_CHECKING(for gl_matchc field in glob_t)
 932 AC_TRY_COMPILE(
 933         [ #include <glob.h> ],
 934         [glob_t g; g.gl_matchc = 1;],
 935         [
 936                 AC_DEFINE(GLOB_HAS_GL_MATCHC, 1,
 937                         [Define if your system glob() function has
 938                         gl_matchc options in glob_t])
 939                 AC_MSG_RESULT(yes)
 940         ],
 941         [
 942                 AC_MSG_RESULT(no)
 943         ]
 944 )
 945
 946 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
 947 AC_RUN_IFELSE(
 948         [AC_LANG_SOURCE([[
 949 #include <sys/types.h>
 950 #include <dirent.h>
 951 int main(void){struct dirent d;exit(sizeof(d.d_name)<=sizeof(char));}
 952         ]])],
 953         [AC_MSG_RESULT(yes)],
 954         [
 955                 AC_MSG_RESULT(no)
 956                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME, 1,
 957                         [Define if your struct dirent expects you to
 958                         allocate extra space for d_name])
 959         ],
 960         [
 961                 AC_MSG_WARN([cross compiling: assuming BROKEN_ONE_BYTE_DIRENT_D_NAME])
 962                 AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
 963         ]
 964 )
 965
 966 AC_MSG_CHECKING([for /proc/pid/fd directory])
 967 if test -d "/proc/$$/fd" ; then
 968         AC_DEFINE(HAVE_PROC_PID, 1, [Define if you have /proc/$pid/fd])
 969         AC_MSG_RESULT(yes)
 970 else
 971         AC_MSG_RESULT(no)
 972 fi
 973
 974 # Check whether user wants S/Key support
 975 SKEY_MSG="no"
 976 AC_ARG_WITH(skey,
 977         [  --with-skey[[=PATH]]      Enable S/Key support (optionally in PATH)],
 978         [
 979                 if test "x$withval" != "xno" ; then
 980
 981                         if test "x$withval" != "xyes" ; then
 982                                 CPPFLAGS="$CPPFLAGS -I${withval}/include"
 983                                 LDFLAGS="$LDFLAGS -L${withval}/lib"
 984                         fi
 985
 986                         AC_DEFINE(SKEY, 1, [Define if you want S/Key support])
 987                         LIBS="-lskey $LIBS"
 988                         SKEY_MSG="yes"
 989
 990                         AC_MSG_CHECKING([for s/key support])
 991                         AC_LINK_IFELSE(
 992                                 [AC_LANG_SOURCE([[
 993 #include <stdio.h>
 994 #include <skey.h>
 995 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
 996                                 ]])],
 997                                 [AC_MSG_RESULT(yes)],
 998                                 [
 999                                         AC_MSG_RESULT(no)
1000                                         AC_MSG_ERROR([** Incomplete or missing s/key libraries.])
1001                                 ])
1002                         AC_MSG_CHECKING(if skeychallenge takes 4 arguments)
1003                         AC_TRY_COMPILE(
1004                                 [#include <stdio.h>
1005                                  #include <skey.h>],
1006                                 [(void)skeychallenge(NULL,"name","",0);],
1007                                 [AC_MSG_RESULT(yes)
1008                                  AC_DEFINE(SKEYCHALLENGE_4ARG, 1,
1009                                         [Define if your skeychallenge()
1010                                         function takes 4 arguments (NetBSD)])],
1011                                 [AC_MSG_RESULT(no)]
1012                         )
1013                 fi
1014         ]
1015 )
1016
1017 # Check whether user wants TCP wrappers support
1018 TCPW_MSG="no"
1019 AC_ARG_WITH(tcp-wrappers,
1020         [  --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1021         [
1022                 if test "x$withval" != "xno" ; then
1023                         saved_LIBS="$LIBS"
1024                         saved_LDFLAGS="$LDFLAGS"
1025                         saved_CPPFLAGS="$CPPFLAGS"
1026                         if test -n "${withval}" && \
1027                             test "x${withval}" != "xyes"; then
1028                                 if test -d "${withval}/lib"; then
1029                                         if test -n "${need_dash_r}"; then
1030                                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1031                                         else
1032                                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1033                                         fi
1034                                 else
1035                                         if test -n "${need_dash_r}"; then
1036                                                 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1037                                         else
1038                                                 LDFLAGS="-L${withval} ${LDFLAGS}"
1039                                         fi
1040                                 fi
1041                                 if test -d "${withval}/include"; then
1042                                         CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1043                                 else
1044                                         CPPFLAGS="-I${withval} ${CPPFLAGS}"
1045                                 fi
1046                         fi
1047                         LIBWRAP="-lwrap"
1048                         LIBS="$LIBWRAP $LIBS"
1049                         AC_MSG_CHECKING(for libwrap)
1050                         AC_TRY_LINK(
1051                                 [
1052 #include <sys/types.h>
1053 #include <sys/socket.h>
1054 #include <netinet/in.h>
1055 #include <tcpd.h>
1056                                         int deny_severity = 0, allow_severity = 0;
1057                                 ],
1058                                 [hosts_access(0);],
1059                                 [
1060                                         AC_MSG_RESULT(yes)
1061                                         AC_DEFINE(LIBWRAP, 1,
1062                                                 [Define if you want
1063                                                 TCP Wrappers support])
1064                                         AC_SUBST(LIBWRAP)
1065                                         TCPW_MSG="yes"
1066                                 ],
1067                                 [
1068                                         AC_MSG_ERROR([*** libwrap missing])
1069                                 ]
1070                         )
1071                         LIBS="$saved_LIBS"
1072                 fi
1073         ]
1074 )
1075
1076 # Check whether user wants libedit support
1077 LIBEDIT_MSG="no"
1078 AC_ARG_WITH(libedit,
1079         [  --with-libedit[[=PATH]]   Enable libedit support for sftp],
1080         [ if test "x$withval" != "xno" ; then
1081                 if test "x$withval" != "xyes"; then
1082                         CPPFLAGS="$CPPFLAGS -I${withval}/include"
1083                         if test -n "${need_dash_r}"; then
1084                                 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1085                         else
1086                                 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1087                         fi
1088                 fi
1089                 AC_CHECK_LIB(edit, el_init,
1090                         [ AC_DEFINE(USE_LIBEDIT, 1, [Use libedit for sftp])
1091                           LIBEDIT="-ledit -lcurses"
1092                           LIBEDIT_MSG="yes"
1093                           AC_SUBST(LIBEDIT)
1094                         ],
1095                         [ AC_MSG_ERROR(libedit not found) ],
1096                         [ -lcurses ]
1097                 )
1098                 AC_MSG_CHECKING(if libedit version is compatible)
1099                 AC_COMPILE_IFELSE(
1100                     [AC_LANG_SOURCE([[
1101 #include <histedit.h>
1102 int main(void)
1103 {
1104         int i = H_SETSIZE;
1105         el_init("", NULL, NULL, NULL);
1106         exit(0);
1107 }
1108                     ]])],
1109                     [ AC_MSG_RESULT(yes) ],
1110                     [ AC_MSG_RESULT(no)
1111                       AC_MSG_ERROR(libedit version is not compatible) ]
1112                 )
1113         fi ]
1114 )
1115
1116 AUDIT_MODULE=none
1117 AC_ARG_WITH(audit,
1118         [  --with-audit=module     Enable EXPERIMENTAL audit support (modules=debug,bsm)],
1119         [
1120           AC_MSG_CHECKING(for supported audit module)
1121           case "$withval" in
1122           bsm)
1123                 AC_MSG_RESULT(bsm)
1124                 AUDIT_MODULE=bsm
1125                 dnl    Checks for headers, libs and functions
1126                 AC_CHECK_HEADERS(bsm/audit.h, [],
1127                     [AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)])
1128                 AC_CHECK_LIB(bsm, getaudit, [],
1129                     [AC_MSG_ERROR(BSM enabled and required library not found)])
1130                 AC_CHECK_FUNCS(getaudit, [],
1131                     [AC_MSG_ERROR(BSM enabled and required function not found)])
1132                 # These are optional
1133                 AC_CHECK_FUNCS(getaudit_addr)
1134                 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
1135                 ;;
1136           debug)
1137                 AUDIT_MODULE=debug
1138                 AC_MSG_RESULT(debug)
1139                 AC_DEFINE(SSH_AUDIT_EVENTS, 1, Use audit debugging module)
1140                 ;;
1141           no)
1142                 AC_MSG_RESULT(no)
1143                 ;;
1144           *)
1145                 AC_MSG_ERROR([Unknown audit module $withval])
1146                 ;;
1147         esac ]
1148 )
1149
1150 dnl    Checks for library functions. Please keep in alphabetical order
1151 AC_CHECK_FUNCS( \
1152         arc4random \
1153         asprintf \
1154         b64_ntop \
1155         __b64_ntop \
1156         b64_pton \
1157         __b64_pton \
1158         bcopy \
1159         bindresvport_sa \
1160         clock \
1161         closefrom \
1162         dirfd \
1163         fchmod \
1164         fchown \
1165         freeaddrinfo \
1166         futimes \
1167         getaddrinfo \
1168         getcwd \
1169         getgrouplist \
1170         getnameinfo \
1171         getopt \
1172         getpeereid \
1173         _getpty \
1174         getrlimit \
1175         getttyent \
1176         glob \
1177         inet_aton \
1178         inet_ntoa \
1179         inet_ntop \
1180         innetgr \
1181         login_getcapbool \
1182         md5_crypt \
1183         memmove \
1184         mkdtemp \
1185         mmap \
1186         ngetaddrinfo \
1187         nsleep \
1188         ogetaddrinfo \
1189         openlog_r \
1190         openpty \
1191         prctl \
1192         pstat \
1193         readpassphrase \
1194         realpath \
1195         recvmsg \
1196         rresvport_af \
1197         sendmsg \
1198         setdtablesize \
1199         setegid \
1200         setenv \
1201         seteuid \
1202         setgroups \
1203         setlogin \
1204         setpcred \
1205         setproctitle \
1206         setregid \
1207         setreuid \
1208         setrlimit \
1209         setsid \
1210         setvbuf \
1211         sigaction \
1212         sigvec \
1213         snprintf \
1214         socketpair \
1215         strdup \
1216         strerror \
1217         strlcat \
1218         strlcpy \
1219         strmode \
1220         strnvis \
1221         strtonum \
1222         strtoll \
1223         strtoul \
1224         sysconf \
1225         tcgetpgrp \
1226         truncate \
1227         unsetenv \
1228         updwtmpx \
1229         vasprintf \
1230         vhangup \
1231         vsnprintf \
1232         waitpid \
1233 )
1234
1235 # IRIX has a const char return value for gai_strerror()
1236 AC_CHECK_FUNCS(gai_strerror,[
1237         AC_DEFINE(HAVE_GAI_STRERROR)
1238         AC_TRY_COMPILE([
1239 #include <sys/types.h>
1240 #include <sys/socket.h>
1241 #include <netdb.h>
1242
1243 const char *gai_strerror(int);],[
1244 char *str;
1245
1246 str = gai_strerror(0);],[
1247                 AC_DEFINE(HAVE_CONST_GAI_STRERROR_PROTO, 1,
1248                 [Define if gai_strerror() returns const char *])])])
1249
1250 AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP, 1,
1251         [Some systems put nanosleep outside of libc]))
1252
1253 dnl Make sure prototypes are defined for these before using them.
1254 AC_CHECK_DECL(getrusage, [AC_CHECK_FUNCS(getrusage)])
1255 AC_CHECK_DECL(strsep,
1256         [AC_CHECK_FUNCS(strsep)],
1257         [],
1258         [
1259 #ifdef HAVE_STRING_H
1260 # include <string.h>
1261 #endif
1262         ])
1263
1264 dnl tcsendbreak might be a macro
1265 AC_CHECK_DECL(tcsendbreak,
1266         [AC_DEFINE(HAVE_TCSENDBREAK)],
1267         [AC_CHECK_FUNCS(tcsendbreak)],
1268         [#include <termios.h>]
1269 )
1270
1271 AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>])
1272
1273 AC_CHECK_FUNCS(setresuid, [
1274         dnl Some platorms have setresuid that isn't implemented, test for this
1275         AC_MSG_CHECKING(if setresuid seems to work)
1276         AC_RUN_IFELSE(
1277                 [AC_LANG_SOURCE([[
1278 #include <stdlib.h>
1279 #include <errno.h>
1280 int main(){errno=0; setresuid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1281                 ]])],
1282                 [AC_MSG_RESULT(yes)],
1283                 [AC_DEFINE(BROKEN_SETRESUID, 1,
1284                         [Define if your setresuid() is broken])
1285                  AC_MSG_RESULT(not implemented)],
1286                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1287         )
1288 ])
1289
1290 AC_CHECK_FUNCS(setresgid, [
1291         dnl Some platorms have setresgid that isn't implemented, test for this
1292         AC_MSG_CHECKING(if setresgid seems to work)
1293         AC_RUN_IFELSE(
1294                 [AC_LANG_SOURCE([[
1295 #include <stdlib.h>
1296 #include <errno.h>
1297 int main(){errno=0; setresgid(0,0,0); if (errno==ENOSYS) exit(1); else exit(0);}
1298                 ]])],
1299                 [AC_MSG_RESULT(yes)],
1300                 [AC_DEFINE(BROKEN_SETRESGID, 1,
1301                         [Define if your setresgid() is broken])
1302                  AC_MSG_RESULT(not implemented)],
1303                 [AC_MSG_WARN([cross compiling: not checking setresuid])]
1304         )
1305 ])
1306
1307 dnl    Checks for time functions
1308 AC_CHECK_FUNCS(gettimeofday time)
1309 dnl    Checks for utmp functions
1310 AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent)
1311 AC_CHECK_FUNCS(utmpname)
1312 dnl    Checks for utmpx functions
1313 AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
1314 AC_CHECK_FUNCS(setutxent utmpxname)
1315
1316 AC_CHECK_FUNC(daemon,
1317         [AC_DEFINE(HAVE_DAEMON, 1, [Define if your libraries define daemon()])],
1318         [AC_CHECK_LIB(bsd, daemon,
1319                 [LIBS="$LIBS -lbsd"; AC_DEFINE(HAVE_DAEMON)])]
1320 )
1321
1322 AC_CHECK_FUNC(getpagesize,
1323         [AC_DEFINE(HAVE_GETPAGESIZE, 1,
1324                 [Define if your libraries define getpagesize()])],
1325         [AC_CHECK_LIB(ucb, getpagesize,
1326                 [LIBS="$LIBS -lucb"; AC_DEFINE(HAVE_GETPAGESIZE)])]
1327 )
1328
1329 # Check for broken snprintf
1330 if test "x$ac_cv_func_snprintf" = "xyes" ; then
1331         AC_MSG_CHECKING([whether snprintf correctly terminates long strings])
1332         AC_RUN_IFELSE(
1333                 [AC_LANG_SOURCE([[
1334 #include <stdio.h>
1335 int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
1336                 ]])],
1337                 [AC_MSG_RESULT(yes)],
1338                 [
1339                         AC_MSG_RESULT(no)
1340                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1341                                 [Define if your snprintf is busted])
1342                         AC_MSG_WARN([****** Your snprintf() function is broken, complain to your vendor])
1343                 ],
1344                 [ AC_MSG_WARN([cross compiling: Assuming working snprintf()]) ]
1345         )
1346 fi
1347
1348 # If we don't have a working asprintf, then we strongly depend on vsnprintf
1349 # returning the right thing on overflow: the number of characters it tried to
1350 # create (as per SUSv3)
1351 if test "x$ac_cv_func_asprintf" != "xyes" && \
1352    test "x$ac_cv_func_vsnprintf" = "xyes" ; then
1353         AC_MSG_CHECKING([whether vsnprintf returns correct values on overflow])
1354         AC_RUN_IFELSE(
1355                 [AC_LANG_SOURCE([[
1356 #include <sys/types.h>
1357 #include <stdio.h>
1358 #include <stdarg.h>
1359
1360 int x_snprintf(char *str,size_t count,const char *fmt,...)
1361 {
1362         size_t ret; va_list ap;
1363         va_start(ap, fmt); ret = vsnprintf(str, count, fmt, ap); va_end(ap);
1364         return ret;
1365 }
1366 int main(void)
1367 {
1368         char x[1];
1369         exit(x_snprintf(x, 1, "%s %d", "hello", 12345) == 11 ? 0 : 1);
1370 } ]])],
1371                 [AC_MSG_RESULT(yes)],
1372                 [
1373                         AC_MSG_RESULT(no)
1374                         AC_DEFINE(BROKEN_SNPRINTF, 1,
1375                                 [Define if your snprintf is busted])
1376                         AC_MSG_WARN([****** Your vsnprintf() function is broken, complain to your vendor])
1377                 ],
1378                 [ AC_MSG_WARN([cross compiling: Assuming working vsnprintf()]) ]
1379         )
1380 fi
1381
1382 # On systems where [v]snprintf is broken, but is declared in stdio,
1383 # check that the fmt argument is const char * or just char *.
1384 # This is only useful for when BROKEN_SNPRINTF
1385 AC_MSG_CHECKING([whether snprintf can declare const char *fmt])
1386 AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#include <stdio.h>
1387            int snprintf(char *a, size_t b, const char *c, ...) { return 0; }
1388            int main(void) { snprintf(0, 0, 0); }
1389     ]])],
1390    [AC_MSG_RESULT(yes)
1391     AC_DEFINE(SNPRINTF_CONST, [const],
1392               [Define as const if snprintf() can declare const char *fmt])],
1393    [AC_MSG_RESULT(no)
1394     AC_DEFINE(SNPRINTF_CONST, [/* not const */])])
1395
1396 # Check for missing getpeereid (or equiv) support
1397 NO_PEERCHECK=""
1398 if test "x$ac_cv_func_getpeereid" != "xyes" ; then
1399         AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
1400         AC_TRY_COMPILE(
1401                 [#include <sys/types.h>
1402                  #include <sys/socket.h>],
1403                 [int i = SO_PEERCRED;],
1404                 [ AC_MSG_RESULT(yes)
1405                   AC_DEFINE(HAVE_SO_PEERCRED, 1, [Have PEERCRED socket option])
1406                 ],
1407                 [AC_MSG_RESULT(no)
1408                 NO_PEERCHECK=1]
1409         )
1410 fi
1411
1412 dnl see whether mkstemp() requires XXXXXX
1413 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
1414 AC_MSG_CHECKING([for (overly) strict mkstemp])
1415 AC_RUN_IFELSE(
1416         [AC_LANG_SOURCE([[
1417 #include <stdlib.h>
1418 main() { char template[]="conftest.mkstemp-test";
1419 if (mkstemp(template) == -1)
1420         exit(1);
1421 unlink(template); exit(0);
1422 }
1423         ]])],
1424         [
1425                 AC_MSG_RESULT(no)
1426         ],
1427         [
1428                 AC_MSG_RESULT(yes)
1429                 AC_DEFINE(HAVE_STRICT_MKSTEMP, 1, [Silly mkstemp()])
1430         ],
1431         [
1432                 AC_MSG_RESULT(yes)
1433                 AC_DEFINE(HAVE_STRICT_MKSTEMP)
1434         ]
1435 )
1436 fi
1437
1438 dnl make sure that openpty does not reacquire controlling terminal
1439 if test ! -z "$check_for_openpty_ctty_bug"; then
1440         AC_MSG_CHECKING(if openpty correctly handles controlling tty)
1441         AC_RUN_IFELSE(
1442                 [AC_LANG_SOURCE([[
1443 #include <stdio.h>
1444 #include <sys/fcntl.h>
1445 #include <sys/types.h>
1446 #include <sys/wait.h>
1447
1448 int
1449 main()
1450 {
1451         pid_t pid;
1452         int fd, ptyfd, ttyfd, status;
1453
1454         pid = fork();
1455         if (pid < 0) {          /* failed */
1456                 exit(1);
1457         } else if (pid > 0) {   /* parent */
1458                 waitpid(pid, &status, 0);
1459                 if (WIFEXITED(status))
1460                         exit(WEXITSTATUS(status));
1461                 else
1462                         exit(2);
1463         } else {                /* child */
1464                 close(0); close(1); close(2);
1465                 setsid();
1466                 openpty(&ptyfd, &ttyfd, NULL, NULL, NULL);
1467                 fd = open("/dev/tty", O_RDWR | O_NOCTTY);
1468                 if (fd >= 0)
1469                         exit(3);        /* Acquired ctty: broken */
1470                 else
1471                         exit(0);        /* Did not acquire ctty: OK */
1472         }
1473 }
1474                 ]])],
1475                 [
1476                         AC_MSG_RESULT(yes)
1477                 ],
1478                 [
1479                         AC_MSG_RESULT(no)
1480                         AC_DEFINE(SSHD_ACQUIRES_CTTY)
1481                 ],
1482                 [
1483                         AC_MSG_RESULT(cross-compiling, assuming yes)
1484                 ]
1485         )
1486 fi
1487
1488 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1489     test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
1490         AC_MSG_CHECKING(if getaddrinfo seems to work)
1491         AC_RUN_IFELSE(
1492                 [AC_LANG_SOURCE([[
1493 #include <stdio.h>
1494 #include <sys/socket.h>
1495 #include <netdb.h>
1496 #include <errno.h>
1497 #include <netinet/in.h>
1498
1499 #define TEST_PORT "2222"
1500
1501 int
1502 main(void)
1503 {
1504         int err, sock;
1505         struct addrinfo *gai_ai, *ai, hints;
1506         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1507
1508         memset(&hints, 0, sizeof(hints));
1509         hints.ai_family = PF_UNSPEC;
1510         hints.ai_socktype = SOCK_STREAM;
1511         hints.ai_flags = AI_PASSIVE;
1512
1513         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1514         if (err != 0) {
1515                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1516                 exit(1);
1517         }
1518
1519         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1520                 if (ai->ai_family != AF_INET6)
1521                         continue;
1522
1523                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1524                     sizeof(ntop), strport, sizeof(strport),
1525                     NI_NUMERICHOST|NI_NUMERICSERV);
1526
1527                 if (err != 0) {
1528                         if (err == EAI_SYSTEM)
1529                                 perror("getnameinfo EAI_SYSTEM");
1530                         else
1531                                 fprintf(stderr, "getnameinfo failed: %s\n",
1532                                     gai_strerror(err));
1533                         exit(2);
1534                 }
1535
1536                 sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
1537                 if (sock < 0)
1538                         perror("socket");
1539                 if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1540                         if (errno == EBADF)
1541                                 exit(3);
1542                 }
1543         }
1544         exit(0);
1545 }
1546                 ]])],
1547                 [
1548                         AC_MSG_RESULT(yes)
1549                 ],
1550                 [
1551                         AC_MSG_RESULT(no)
1552                         AC_DEFINE(BROKEN_GETADDRINFO)
1553                 ],
1554                 [
1555                         AC_MSG_RESULT(cross-compiling, assuming yes)
1556                 ]
1557         )
1558 fi
1559
1560 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
1561     test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
1562         AC_MSG_CHECKING(if getaddrinfo seems to work)
1563         AC_RUN_IFELSE(
1564                 [AC_LANG_SOURCE([[
1565 #include <stdio.h>
1566 #include <sys/socket.h>
1567 #include <netdb.h>
1568 #include <errno.h>
1569 #include <netinet/in.h>
1570
1571 #define TEST_PORT "2222"
1572
1573 int
1574 main(void)
1575 {
1576         int err, sock;
1577         struct addrinfo *gai_ai, *ai, hints;
1578         char ntop[NI_MAXHOST], strport[NI_MAXSERV], *name = NULL;
1579
1580         memset(&hints, 0, sizeof(hints));
1581         hints.ai_family = PF_UNSPEC;
1582         hints.ai_socktype = SOCK_STREAM;
1583         hints.ai_flags = AI_PASSIVE;
1584
1585         err = getaddrinfo(name, TEST_PORT, &hints, &gai_ai);
1586         if (err != 0) {
1587                 fprintf(stderr, "getaddrinfo failed (%s)", gai_strerror(err));
1588                 exit(1);
1589         }
1590
1591         for (ai = gai_ai; ai != NULL; ai = ai->ai_next) {
1592                 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1593                         continue;
1594
1595                 err = getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop,
1596                     sizeof(ntop), strport, sizeof(strport),
1597                     NI_NUMERICHOST|NI_NUMERICSERV);
1598
1599                 if (ai->ai_family == AF_INET && err != 0) {
1600                         perror("getnameinfo");
1601                         exit(2);
1602                 }
1603         }
1604         exit(0);
1605 }
1606                 ]])],
1607                 [
1608                         AC_MSG_RESULT(yes)
1609                         AC_DEFINE(AIX_GETNAMEINFO_HACK, 1,
1610                                 [Define if you have a getaddrinfo that fails
1611                                 for the all-zeros IPv6 address])
1612                 ],
1613                 [
1614                         AC_MSG_RESULT(no)
1615                         AC_DEFINE(BROKEN_GETADDRINFO)
1616                 ],
1617                         AC_MSG_RESULT(cross-compiling, assuming no)
1618                 ]
1619         )
1620 fi
1621
1622 if test "x$check_for_conflicting_getspnam" = "x1"; then
1623         AC_MSG_CHECKING(for conflicting getspnam in shadow.h)
1624         AC_COMPILE_IFELSE(
1625                 [
1626 #include <shadow.h>
1627 int main(void) {exit(0);}
1628                 ],
1629                 [
1630                         AC_MSG_RESULT(no)
1631                 ],
1632                 [
1633                         AC_MSG_RESULT(yes)
1634                         AC_DEFINE(GETSPNAM_CONFLICTING_DEFS, 1,
1635                             [Conflicting defs for getspnam])
1636                 ]
1637         )
1638 fi
1639
1640 AC_FUNC_GETPGRP
1641
1642 # Check for PAM libs
1643 PAM_MSG="no"
1644 AC_ARG_WITH(pam,
1645         [  --with-pam              Enable PAM support ],
1646         [
1647                 if test "x$withval" != "xno" ; then
1648                         if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
1649                            test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
1650                                 AC_MSG_ERROR([PAM headers not found])
1651                         fi
1652
1653                         AC_CHECK_LIB(dl, dlopen, , )
1654                         AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
1655                         AC_CHECK_FUNCS(pam_getenvlist)
1656                         AC_CHECK_FUNCS(pam_putenv)
1657
1658                         PAM_MSG="yes"
1659
1660                         AC_DEFINE(USE_PAM, 1,
1661                                 [Define if you want to enable PAM support])
1662                         if test $ac_cv_lib_dl_dlopen = yes; then
1663                                 LIBPAM="-lpam -ldl"
1664                         else
1665                                 LIBPAM="-lpam"
1666                         fi
1667                         AC_SUBST(LIBPAM)
1668                 fi
1669         ]
1670 )
1671
1672 # Check for older PAM
1673 if test "x$PAM_MSG" = "xyes" ; then
1674         # Check PAM strerror arguments (old PAM)
1675         AC_MSG_CHECKING([whether pam_strerror takes only one argument])
1676         AC_TRY_COMPILE(
1677                 [
1678 #include <stdlib.h>
1679 #if defined(HAVE_SECURITY_PAM_APPL_H)
1680 #include <security/pam_appl.h>
1681 #elif defined (HAVE_PAM_PAM_APPL_H)
1682 #include <pam/pam_appl.h>
1683 #endif
1684                 ],
1685                 [(void)pam_strerror((pam_handle_t *)NULL, -1);],
1686                 [AC_MSG_RESULT(no)],
1687                 [
1688                         AC_DEFINE(HAVE_OLD_PAM, 1,
1689                                 [Define if you have an old version of PAM
1690                                 which takes only one argument to pam_strerror])
1691                         AC_MSG_RESULT(yes)
1692                         PAM_MSG="yes (old library)"
1693                 ]
1694         )
1695 fi
1696
1697 # Search for OpenSSL
1698 saved_CPPFLAGS="$CPPFLAGS"
1699 saved_LDFLAGS="$LDFLAGS"
1700 AC_ARG_WITH(ssl-dir,
1701         [  --with-ssl-dir=PATH     Specify path to OpenSSL installation ],
1702         [
1703                 if test "x$withval" != "xno" ; then
1704                         case "$withval" in
1705                                 # Relative paths
1706                                 ./*|../*)       withval="`pwd`/$withval"
1707                         esac
1708                         if test -d "$withval/lib"; then
1709                                 if test -n "${need_dash_r}"; then
1710                                         LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1711                                 else
1712                                         LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1713                                 fi
1714                         else
1715                                 if test -n "${need_dash_r}"; then
1716                                         LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1717                                 else
1718                                         LDFLAGS="-L${withval} ${LDFLAGS}"
1719                                 fi
1720                         fi
1721                         if test -d "$withval/include"; then
1722                                 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1723                         else
1724                                 CPPFLAGS="-I${withval} ${CPPFLAGS}"
1725                         fi
1726                 fi
1727         ]
1728 )
1729 LIBS="-lcrypto $LIBS"
1730 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL, 1,
1731         [Define if your ssl headers are included
1732         with #include <openssl/header.h>]),
1733         [
1734                 dnl Check default openssl install dir
1735                 if test -n "${need_dash_r}"; then
1736                         LDFLAGS="-L/usr/local/ssl/lib -R/usr/local/ssl/lib ${saved_LDFLAGS}"
1737                 else
1738                         LDFLAGS="-L/usr/local/ssl/lib ${saved_LDFLAGS}"
1739                 fi
1740                 CPPFLAGS="-I/usr/local/ssl/include ${saved_CPPFLAGS}"
1741                 AC_TRY_LINK_FUNC(RAND_add, AC_DEFINE(HAVE_OPENSSL),
1742                         [
1743                                 AC_MSG_ERROR([*** Can't find recent OpenSSL libcrypto (see config.log for details) ***])
1744                         ]
1745                 )
1746         ]
1747 )
1748
1749 # Determine OpenSSL header version
1750 AC_MSG_CHECKING([OpenSSL header version])
1751 AC_RUN_IFELSE(
1752         [AC_LANG_SOURCE([[
1753 #include <stdio.h>
1754 #include <string.h>
1755 #include <openssl/opensslv.h>
1756 #define DATA "conftest.sslincver"
1757 int main(void) {
1758         FILE *fd;
1759         int rc;
1760
1761         fd = fopen(DATA,"w");
1762         if(fd == NULL)
1763                 exit(1);
1764
1765         if ((rc = fprintf(fd ,"%x (%s)\n", OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_TEXT)) <0)
1766                 exit(1);
1767
1768         exit(0);
1769 }
1770         ]])],
1771         [
1772                 ssl_header_ver=`cat conftest.sslincver`
1773                 AC_MSG_RESULT($ssl_header_ver)
1774         ],
1775         [
1776                 AC_MSG_RESULT(not found)
1777                 AC_MSG_ERROR(OpenSSL version header not found.)
1778         ],
1779         [
1780                 AC_MSG_WARN([cross compiling: not checking])
1781         ]
1782 )
1783
1784 # Determine OpenSSL library version
1785 AC_MSG_CHECKING([OpenSSL library version])
1786 AC_RUN_IFELSE(
1787         [AC_LANG_SOURCE([[
1788 #include <stdio.h>
1789 #include <string.h>
1790 #include <openssl/opensslv.h>
1791 #include <openssl/crypto.h>
1792 #define DATA "conftest.ssllibver"
1793 int main(void) {
1794         FILE *fd;
1795         int rc;
1796
1797         fd = fopen(DATA,"w");
1798         if(fd == NULL)
1799                 exit(1);
1800
1801         if ((rc = fprintf(fd ,"%x (%s)\n", SSLeay(), SSLeay_version(SSLEAY_VERSION))) <0)
1802                 exit(1);
1803
1804         exit(0);
1805 }
1806         ]])],
1807         [
1808                 ssl_library_ver=`cat conftest.ssllibver`
1809                 AC_MSG_RESULT($ssl_library_ver)
1810         ],
1811         [
1812                 AC_MSG_RESULT(not found)
1813                 AC_MSG_ERROR(OpenSSL library not found.)
1814         ],
1815         [
1816                 AC_MSG_WARN([cross compiling: not checking])
1817         ]
1818 )
1819
1820 # Sanity check OpenSSL headers
1821 AC_MSG_CHECKING([whether OpenSSL's headers match the library])
1822 AC_RUN_IFELSE(
1823         [AC_LANG_SOURCE([[
1824 #include <string.h>
1825 #include <openssl/opensslv.h>
1826 int main(void) { exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
1827         ]])],
1828         [
1829                 AC_MSG_RESULT(yes)
1830         ],
1831         [
1832                 AC_MSG_RESULT(no)
1833                 AC_MSG_ERROR([Your OpenSSL headers do not match your library.
1834 Check config.log for details.
1835 Also see contrib/findssl.sh for help identifying header/library mismatches.])
1836         ],
1837         [
1838                 AC_MSG_WARN([cross compiling: not checking])
1839         ]
1840 )
1841
1842 AC_ARG_WITH(ssl-engine,
1843         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
1844         [ if test "x$withval" != "xno" ; then
1845                 AC_MSG_CHECKING(for OpenSSL ENGINE support)
1846                 AC_TRY_COMPILE(
1847                         [ #include <openssl/engine.h>],
1848                         [
1849 int main(void){ENGINE_load_builtin_engines();ENGINE_register_all_complete();}
1850                         ],
1851                         [ AC_MSG_RESULT(yes)
1852                           AC_DEFINE(USE_OPENSSL_ENGINE, 1,
1853                              [Enable OpenSSL engine support])
1854                         ],
1855                         [ AC_MSG_ERROR(OpenSSL ENGINE support not found)]
1856                 )
1857           fi ]
1858 )
1859
1860 # Check for OpenSSL without EVP_aes_{192,256}_cbc
1861 AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
1862 AC_COMPILE_IFELSE(
1863         [AC_LANG_SOURCE([[
1864 #include <string.h>
1865 #include <openssl/evp.h>
1866 int main(void) { exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL);}
1867         ]])],
1868         [
1869                 AC_MSG_RESULT(no)
1870         ],
1871         [
1872                 AC_MSG_RESULT(yes)
1873                 AC_DEFINE(OPENSSL_LOBOTOMISED_AES, 1,
1874                     [libcrypto is missing AES 192 and 256 bit functions])
1875         ]
1876 )
1877
1878 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
1879 # because the system crypt() is more featureful.
1880 if test "x$check_for_libcrypt_before" = "x1"; then
1881         AC_CHECK_LIB(crypt, crypt)
1882 fi
1883
1884 # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the
1885 # version in OpenSSL.
1886 if test "x$check_for_libcrypt_later" = "x1"; then
1887         AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
1888 fi
1889
1890 # Search for SHA256 support in libc and/or OpenSSL
1891 AC_CHECK_FUNCS(SHA256_Update EVP_sha256)
1892
1893 AC_CHECK_LIB(iaf, ia_openinfo)
1894
1895 ### Configure cryptographic random number support
1896
1897 # Check wheter OpenSSL seeds itself
1898 AC_MSG_CHECKING([whether OpenSSL's PRNG is internally seeded])
1899 AC_RUN_IFELSE(
1900         [AC_LANG_SOURCE([[
1901 #include <string.h>
1902 #include <openssl/rand.h>
1903 int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
1904         ]])],
1905         [
1906                 OPENSSL_SEEDS_ITSELF=yes
1907                 AC_MSG_RESULT(yes)
1908         ],
1909         [
1910                 AC_MSG_RESULT(no)
1911                 # Default to use of the rand helper if OpenSSL doesn't
1912                 # seed itself
1913                 USE_RAND_HELPER=yes
1914         ],
1915         [
1916                 AC_MSG_WARN([cross compiling: assuming yes])
1917                 # This is safe, since all recent OpenSSL versions will
1918                 # complain at runtime if not seeded correctly.
1919                 OPENSSL_SEEDS_ITSELF=yes
1920         ]
1921 )
1922
1923
1924 # Do we want to force the use of the rand helper?
1925 AC_ARG_WITH(rand-helper,
1926         [  --with-rand-helper      Use subprocess to gather strong randomness ],
1927         [
1928                 if test "x$withval" = "xno" ; then
1929                         # Force use of OpenSSL's internal RNG, even if
1930                         # the previous test showed it to be unseeded.
1931                         if test -z "$OPENSSL_SEEDS_ITSELF" ; then
1932                                 AC_MSG_WARN([*** Forcing use of OpenSSL's non-self-seeding PRNG])
1933                                 OPENSSL_SEEDS_ITSELF=yes
1934                                 USE_RAND_HELPER=""
1935                         fi
1936                 else
1937                         USE_RAND_HELPER=yes
1938                 fi
1939         ],
1940 )
1941
1942 # Which randomness source do we use?
1943 if test ! -z "$OPENSSL_SEEDS_ITSELF" && test -z "$USE_RAND_HELPER" ; then
1944         # OpenSSL only
1945         AC_DEFINE(OPENSSL_PRNG_ONLY, 1,
1946                 [Define if you want OpenSSL's internally seeded PRNG only])
1947         RAND_MSG="OpenSSL internal ONLY"
1948         INSTALL_SSH_RAND_HELPER=""
1949 elif test ! -z "$USE_RAND_HELPER" ; then
1950         # install rand helper
1951         RAND_MSG="ssh-rand-helper"
1952         INSTALL_SSH_RAND_HELPER="yes"
1953 fi
1954 AC_SUBST(INSTALL_SSH_RAND_HELPER)
1955
1956 ### Configuration of ssh-rand-helper
1957
1958 # PRNGD TCP socket
1959 AC_ARG_WITH(prngd-port,
1960         [  --with-prngd-port=PORT  read entropy from PRNGD/EGD TCP localhost:PORT],
1961         [
1962                 case "$withval" in
1963                 no)
1964                         withval=""
1965                         ;;
1966                 [[0-9]]*)
1967                         ;;
1968                 *)
1969                         AC_MSG_ERROR(You must specify a numeric port number for --with-prngd-port)
1970                         ;;
1971                 esac
1972                 if test ! -z "$withval" ; then
1973                         PRNGD_PORT="$withval"
1974                         AC_DEFINE_UNQUOTED(PRNGD_PORT, $PRNGD_PORT,
1975                                 [Port number of PRNGD/EGD random number socket])
1976                 fi
1977         ]
1978 )
1979
1980 # PRNGD Unix domain socket
1981 AC_ARG_WITH(prngd-socket,
1982         [  --with-prngd-socket=FILE read entropy from PRNGD/EGD socket FILE (default=/var/run/egd-pool)],
1983         [
1984                 case "$withval" in
1985                 yes)
1986                         withval="/var/run/egd-pool"
1987                         ;;
1988                 no)
1989                         withval=""
1990                         ;;
1991                 /*)
1992                         ;;
1993                 *)
1994                         AC_MSG_ERROR(You must specify an absolute path to the entropy socket)
1995                         ;;
1996                 esac
1997
1998                 if test ! -z "$withval" ; then
1999                         if test ! -z "$PRNGD_PORT" ; then
2000                                 AC_MSG_ERROR(You may not specify both a PRNGD/EGD port and socket)
2001                         fi
2002                         if test ! -r "$withval" ; then
2003                                 AC_MSG_WARN(Entropy socket is not readable)
2004                         fi
2005                         PRNGD_SOCKET="$withval"
2006                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET",
2007                                 [Location of PRNGD/EGD random number socket])
2008                 fi
2009         ],
2010         [
2011                 # Check for existing socket only if we don't have a random device already
2012                 if test "$USE_RAND_HELPER" = yes ; then
2013                         AC_MSG_CHECKING(for PRNGD/EGD socket)
2014                         # Insert other locations here
2015                         for sock in /var/run/egd-pool /dev/egd-pool /etc/entropy; do
2016                                 if test -r $sock && $TEST_MINUS_S_SH -c "test -S $sock -o -p $sock" ; then
2017                                         PRNGD_SOCKET="$sock"
2018                                         AC_DEFINE_UNQUOTED(PRNGD_SOCKET, "$PRNGD_SOCKET")
2019                                         break;
2020                                 fi
2021                         done
2022                         if test ! -z "$PRNGD_SOCKET" ; then
2023                                 AC_MSG_RESULT($PRNGD_SOCKET)
2024                         else
2025                                 AC_MSG_RESULT(not found)
2026                         fi
2027                 fi
2028         ]
2029 )
2030
2031 # Change default command timeout for hashing entropy source
2032 entropy_timeout=200
2033 AC_ARG_WITH(entropy-timeout,
2034         [  --with-entropy-timeout  Specify entropy gathering command timeout (msec)],
2035         [
2036                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2037                     test "x${withval}" != "xyes"; then
2038                         entropy_timeout=$withval
2039                 fi
2040         ]
2041 )
2042 AC_DEFINE_UNQUOTED(ENTROPY_TIMEOUT_MSEC, $entropy_timeout,
2043         [Builtin PRNG command timeout])
2044
2045 SSH_PRIVSEP_USER=sshd
2046 AC_ARG_WITH(privsep-user,
2047         [  --with-privsep-user=user Specify non-privileged user for privilege separation],
2048         [
2049                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
2050                     test "x${withval}" != "xyes"; then
2051                         SSH_PRIVSEP_USER=$withval
2052                 fi
2053         ]
2054 )
2055 AC_DEFINE_UNQUOTED(SSH_PRIVSEP_USER, "$SSH_PRIVSEP_USER",
2056         [non-privileged user for privilege separation])
2057 AC_SUBST(SSH_PRIVSEP_USER)
2058
2059 # We do this little dance with the search path to insure
2060 # that programs that we select for use by installed programs
2061 # (which may be run by the super-user) come from trusted
2062 # locations before they come from the user's private area.
2063 # This should help avoid accidentally configuring some
2064 # random version of a program in someone's personal bin.
2065
2066 OPATH=$PATH
2067 PATH=/bin:/usr/bin
2068 test -h /bin 2> /dev/null && PATH=/usr/bin
2069 test -d /sbin && PATH=$PATH:/sbin
2070 test -d /usr/sbin && PATH=$PATH:/usr/sbin
2071 PATH=$PATH:/etc:$OPATH
2072
2073 # These programs are used by the command hashing source to gather entropy
2074 OSSH_PATH_ENTROPY_PROG(PROG_LS, ls)
2075 OSSH_PATH_ENTROPY_PROG(PROG_NETSTAT, netstat)
2076 OSSH_PATH_ENTROPY_PROG(PROG_ARP, arp)
2077 OSSH_PATH_ENTROPY_PROG(PROG_IFCONFIG, ifconfig)
2078 OSSH_PATH_ENTROPY_PROG(PROG_JSTAT, jstat)
2079 OSSH_PATH_ENTROPY_PROG(PROG_PS, ps)
2080 OSSH_PATH_ENTROPY_PROG(PROG_SAR, sar)
2081 OSSH_PATH_ENTROPY_PROG(PROG_W, w)
2082 OSSH_PATH_ENTROPY_PROG(PROG_WHO, who)
2083 OSSH_PATH_ENTROPY_PROG(PROG_LAST, last)
2084 OSSH_PATH_ENTROPY_PROG(PROG_LASTLOG, lastlog)
2085 OSSH_PATH_ENTROPY_PROG(PROG_DF, df)
2086 OSSH_PATH_ENTROPY_PROG(PROG_VMSTAT, vmstat)
2087 OSSH_PATH_ENTROPY_PROG(PROG_UPTIME, uptime)
2088 OSSH_PATH_ENTROPY_PROG(PROG_IPCS, ipcs)
2089 OSSH_PATH_ENTROPY_PROG(PROG_TAIL, tail)
2090 # restore PATH
2091 PATH=$OPATH
2092
2093 # Where does ssh-rand-helper get its randomness from?
2094 INSTALL_SSH_PRNG_CMDS=""
2095 if test ! -z "$INSTALL_SSH_RAND_HELPER" ; then
2096         if test ! -z "$PRNGD_PORT" ; then
2097                 RAND_HELPER_MSG="TCP localhost:$PRNGD_PORT"
2098         elif test ! -z "$PRNGD_SOCKET" ; then
2099                 RAND_HELPER_MSG="Unix domain socket \"$PRNGD_SOCKET\""
2100         else
2101                 RAND_HELPER_MSG="Command hashing (timeout $entropy_timeout)"
2102                 RAND_HELPER_CMDHASH=yes
2103                 INSTALL_SSH_PRNG_CMDS="yes"
2104         fi
2105 fi
2106 AC_SUBST(INSTALL_SSH_PRNG_CMDS)
2107
2108
2109 # Cheap hack to ensure NEWS-OS libraries are arranged right.
2110 if test ! -z "$SONY" ; then
2111   LIBS="$LIBS -liberty";
2112 fi
2113
2114 # Check for  long long datatypes
2115 AC_CHECK_TYPES([long long, unsigned long long, long double])
2116
2117 # Check datatype sizes
2118 AC_CHECK_SIZEOF(char, 1)
2119 AC_CHECK_SIZEOF(short int, 2)
2120 AC_CHECK_SIZEOF(int, 4)
2121 AC_CHECK_SIZEOF(long int, 4)
2122 AC_CHECK_SIZEOF(long long int, 8)
2123
2124 # Sanity check long long for some platforms (AIX)
2125 if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
2126         ac_cv_sizeof_long_long_int=0
2127 fi
2128
2129 # compute LLONG_MIN and LLONG_MAX if we don't know them.
2130 if test -z "$have_llong_max"; then
2131         AC_MSG_CHECKING([for max value of long long])
2132         AC_RUN_IFELSE(
2133                 [AC_LANG_SOURCE([[
2134 #include <stdio.h>
2135 /* Why is this so damn hard? */
2136 #ifdef __GNUC__
2137 # undef __GNUC__
2138 #endif
2139 #define __USE_ISOC99
2140 #include <limits.h>
2141 #define DATA "conftest.llminmax"
2142 #define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
2143
2144 /*
2145  * printf in libc on some platforms (eg old Tru64) does not understand %lld so
2146  * we do this the hard way.
2147  */
2148 static int
2149 fprint_ll(FILE *f, long long n)
2150 {
2151         unsigned int i;
2152         int l[sizeof(long long) * 8];
2153
2154         if (n < 0)
2155                 if (fprintf(f, "-") < 0)
2156                         return -1;
2157         for (i = 0; n != 0; i++) {
2158                 l[i] = my_abs(n % 10);
2159                 n /= 10;
2160         }
2161         do {
2162                 if (fprintf(f, "%d", l[--i]) < 0)
2163                         return -1;
2164         } while (i != 0);
2165         if (fprintf(f, " ") < 0)
2166                 return -1;
2167         return 0;
2168 }
2169
2170 int main(void) {
2171         FILE *f;
2172         long long i, llmin, llmax = 0;
2173
2174         if((f = fopen(DATA,"w")) == NULL)
2175                 exit(1);
2176
2177 #if defined(LLONG_MIN) && defined(LLONG_MAX)
2178         fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
2179         llmin = LLONG_MIN;
2180         llmax = LLONG_MAX;
2181 #else
2182         fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
2183         /* This will work on one's complement and two's complement */
2184         for (i = 1; i > llmax; i <<= 1, i++)
2185                 llmax = i;
2186         llmin = llmax + 1LL;    /* wrap */
2187 #endif
2188
2189         /* Sanity check */
2190         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
2191             || llmax - 1 > llmax || llmin == llmax || llmin == 0
2192             || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
2193                 fprintf(f, "unknown unknown\n");
2194                 exit(2);
2195         }
2196
2197         if (fprint_ll(f, llmin) < 0)
2198                 exit(3);
2199         if (fprint_ll(f, llmax) < 0)
2200                 exit(4);
2201         if (fclose(f) < 0)
2202                 exit(5);
2203         exit(0);
2204 }
2205                 ]])],
2206                 [
2207                         llong_min=`$AWK '{print $1}' conftest.llminmax`
2208                         llong_max=`$AWK '{print $2}' conftest.llminmax`
2209
2210                         AC_MSG_RESULT($llong_max)
2211                         AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
2212                             [max value of long long calculated by configure])
2213                         AC_MSG_CHECKING([for min value of long long])
2214                         AC_MSG_RESULT($llong_min)
2215                         AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
2216                             [min value of long long calculated by configure])
2217                 ],
2218                 [
2219                         AC_MSG_RESULT(not found)
2220                 ],
2221                 [
2222                         AC_MSG_WARN([cross compiling: not checking])
2223                 ]
2224         )
2225 fi
2226
2227
2228 # More checks for data types
2229 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
2230         AC_TRY_COMPILE(
2231                 [ #include <sys/types.h> ],
2232                 [ u_int a; a = 1;],
2233                 [ ac_cv_have_u_int="yes" ],
2234                 [ ac_cv_have_u_int="no" ]
2235         )
2236 ])
2237 if test "x$ac_cv_have_u_int" = "xyes" ; then
2238         AC_DEFINE(HAVE_U_INT, 1, [define if you have u_int data type])
2239         have_u_int=1
2240 fi
2241
2242 AC_CACHE_CHECK([for intXX_t types], ac_cv_have_intxx_t, [
2243         AC_TRY_COMPILE(
2244                 [ #include <sys/types.h> ],
2245                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2246                 [ ac_cv_have_intxx_t="yes" ],
2247                 [ ac_cv_have_intxx_t="no" ]
2248         )
2249 ])
2250 if test "x$ac_cv_have_intxx_t" = "xyes" ; then
2251         AC_DEFINE(HAVE_INTXX_T, 1, [define if you have intxx_t data type])
2252         have_intxx_t=1
2253 fi
2254
2255 if (test -z "$have_intxx_t" && \
2256            test "x$ac_cv_header_stdint_h" = "xyes")
2257 then
2258     AC_MSG_CHECKING([for intXX_t types in stdint.h])
2259         AC_TRY_COMPILE(
2260                 [ #include <stdint.h> ],
2261                 [ int8_t a; int16_t b; int32_t c; a = b = c = 1;],
2262                 [
2263                         AC_DEFINE(HAVE_INTXX_T)
2264                         AC_MSG_RESULT(yes)
2265                 ],
2266                 [ AC_MSG_RESULT(no) ]
2267         )
2268 fi
2269
2270 AC_CACHE_CHECK([for int64_t type], ac_cv_have_int64_t, [
2271         AC_TRY_COMPILE(
2272                 [
2273 #include <sys/types.h>
2274 #ifdef HAVE_STDINT_H
2275 # include <stdint.h>
2276 #endif
2277 #include <sys/socket.h>
2278 #ifdef HAVE_SYS_BITYPES_H
2279 # include <sys/bitypes.h>
2280 #endif
2281                 ],
2282                 [ int64_t a; a = 1;],
2283                 [ ac_cv_have_int64_t="yes" ],
2284                 [ ac_cv_have_int64_t="no" ]
2285         )
2286 ])
2287 if test "x$ac_cv_have_int64_t" = "xyes" ; then
2288         AC_DEFINE(HAVE_INT64_T, 1, [define if you have int64_t data type])
2289 fi
2290
2291 AC_CACHE_CHECK([for u_intXX_t types], ac_cv_have_u_intxx_t, [
2292         AC_TRY_COMPILE(
2293                 [ #include <sys/types.h> ],
2294                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2295                 [ ac_cv_have_u_intxx_t="yes" ],
2296                 [ ac_cv_have_u_intxx_t="no" ]
2297         )
2298 ])
2299 if test "x$ac_cv_have_u_intxx_t" = "xyes" ; then
2300         AC_DEFINE(HAVE_U_INTXX_T, 1, [define if you have u_intxx_t data type])
2301         have_u_intxx_t=1
2302 fi
2303
2304 if test -z "$have_u_intxx_t" ; then
2305     AC_MSG_CHECKING([for u_intXX_t types in sys/socket.h])
2306         AC_TRY_COMPILE(
2307                 [ #include <sys/socket.h> ],
2308                 [ u_int8_t a; u_int16_t b; u_int32_t c; a = b = c = 1;],
2309                 [
2310                         AC_DEFINE(HAVE_U_INTXX_T)
2311                         AC_MSG_RESULT(yes)
2312                 ],
2313                 [ AC_MSG_RESULT(no) ]
2314         )
2315 fi
2316
2317 AC_CACHE_CHECK([for u_int64_t types], ac_cv_have_u_int64_t, [
2318         AC_TRY_COMPILE(
2319                 [ #include <sys/types.h> ],
2320                 [ u_int64_t a; a = 1;],
2321                 [ ac_cv_have_u_int64_t="yes" ],
2322                 [ ac_cv_have_u_int64_t="no" ]
2323         )
2324 ])
2325 if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
2326         AC_DEFINE(HAVE_U_INT64_T, 1, [define if you have u_int64_t data type])
2327         have_u_int64_t=1
2328 fi
2329
2330 if test -z "$have_u_int64_t" ; then
2331     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
2332         AC_TRY_COMPILE(
2333                 [ #include <sys/bitypes.h> ],
2334                 [ u_int64_t a; a = 1],
2335                 [
2336                         AC_DEFINE(HAVE_U_INT64_T)
2337                         AC_MSG_RESULT(yes)
2338                 ],
2339                 [ AC_MSG_RESULT(no) ]
2340         )
2341 fi
2342
2343 if test -z "$have_u_intxx_t" ; then
2344         AC_CACHE_CHECK([for uintXX_t types], ac_cv_have_uintxx_t, [
2345                 AC_TRY_COMPILE(
2346                         [
2347 #include <sys/types.h>
2348                         ],
2349                         [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1; ],
2350                         [ ac_cv_have_uintxx_t="yes" ],
2351                         [ ac_cv_have_uintxx_t="no" ]
2352                 )
2353         ])
2354         if test "x$ac_cv_have_uintxx_t" = "xyes" ; then
2355                 AC_DEFINE(HAVE_UINTXX_T, 1,
2356                         [define if you have uintxx_t data type])
2357         fi
2358 fi
2359
2360 if test -z "$have_uintxx_t" ; then
2361     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
2362         AC_TRY_COMPILE(
2363                 [ #include <stdint.h> ],
2364                 [ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;],
2365                 [
2366                         AC_DEFINE(HAVE_UINTXX_T)
2367                         AC_MSG_RESULT(yes)
2368                 ],
2369                 [ AC_MSG_RESULT(no) ]
2370         )
2371 fi
2372
2373 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
2374            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
2375 then
2376         AC_MSG_CHECKING([for intXX_t and u_intXX_t types in sys/bitypes.h])
2377         AC_TRY_COMPILE(
2378                 [
2379 #include <sys/bitypes.h>
2380                 ],
2381                 [
2382                         int8_t a; int16_t b; int32_t c;
2383                         u_int8_t e; u_int16_t f; u_int32_t g;
2384                         a = b = c = e = f = g = 1;
2385                 ],
2386                 [
2387                         AC_DEFINE(HAVE_U_INTXX_T)
2388                         AC_DEFINE(HAVE_INTXX_T)
2389                         AC_MSG_RESULT(yes)
2390                 ],
2391                 [AC_MSG_RESULT(no)]
2392         )
2393 fi
2394
2395
2396 AC_CACHE_CHECK([for u_char], ac_cv_have_u_char, [
2397         AC_TRY_COMPILE(
2398                 [
2399 #include <sys/types.h>
2400                 ],
2401                 [ u_char foo; foo = 125; ],
2402                 [ ac_cv_have_u_char="yes" ],
2403                 [ ac_cv_have_u_char="no" ]
2404         )
2405 ])
2406 if test "x$ac_cv_have_u_char" = "xyes" ; then
2407         AC_DEFINE(HAVE_U_CHAR, 1, [define if you have u_char data type])
2408 fi
2409
2410 TYPE_SOCKLEN_T
2411
2412 AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
2413
2414 AC_CHECK_TYPES(in_addr_t,,,
2415 [#include <sys/types.h>
2416 #include <netinet/in.h>])
2417
2418 AC_CACHE_CHECK([for size_t], ac_cv_have_size_t, [
2419         AC_TRY_COMPILE(
2420                 [
2421 #include <sys/types.h>
2422                 ],
2423                 [ size_t foo; foo = 1235; ],
2424                 [ ac_cv_have_size_t="yes" ],
2425                 [ ac_cv_have_size_t="no" ]
2426         )
2427 ])
2428 if test "x$ac_cv_have_size_t" = "xyes" ; then
2429         AC_DEFINE(HAVE_SIZE_T, 1, [define if you have size_t data type])
2430 fi
2431
2432 AC_CACHE_CHECK([for ssize_t], ac_cv_have_ssize_t, [
2433         AC_TRY_COMPILE(
2434                 [
2435 #include <sys/types.h>
2436                 ],
2437                 [ ssize_t foo; foo = 1235; ],
2438                 [ ac_cv_have_ssize_t="yes" ],
2439                 [ ac_cv_have_ssize_t="no" ]
2440         )
2441 ])
2442 if test "x$ac_cv_have_ssize_t" = "xyes" ; then
2443         AC_DEFINE(HAVE_SSIZE_T, 1, [define if you have ssize_t data type])
2444 fi
2445
2446 AC_CACHE_CHECK([for clock_t], ac_cv_have_clock_t, [
2447         AC_TRY_COMPILE(
2448                 [
2449 #include <time.h>
2450                 ],
2451                 [ clock_t foo; foo = 1235; ],
2452                 [ ac_cv_have_clock_t="yes" ],
2453                 [ ac_cv_have_clock_t="no" ]
2454         )
2455 ])
2456 if test "x$ac_cv_have_clock_t" = "xyes" ; then
2457         AC_DEFINE(HAVE_CLOCK_T, 1, [define if you have clock_t data type])
2458 fi
2459
2460 AC_CACHE_CHECK([for sa_family_t], ac_cv_have_sa_family_t, [
2461         AC_TRY_COMPILE(
2462                 [
2463 #include <sys/types.h>
2464 #include <sys/socket.h>
2465                 ],
2466                 [ sa_family_t foo; foo = 1235; ],
2467                 [ ac_cv_have_sa_family_t="yes" ],
2468                 [ AC_TRY_COMPILE(
2469                   [
2470 #include <sys/types.h>
2471 #include <sys/socket.h>
2472 #include <netinet/in.h>
2473                 ],
2474                 [ sa_family_t foo; foo = 1235; ],
2475                 [ ac_cv_have_sa_family_t="yes" ],
2476
2477                 [ ac_cv_have_sa_family_t="no" ]
2478         )]
2479         )
2480 ])
2481 if test "x$ac_cv_have_sa_family_t" = "xyes" ; then
2482         AC_DEFINE(HAVE_SA_FAMILY_T, 1,
2483                 [define if you have sa_family_t data type])
2484 fi
2485
2486 AC_CACHE_CHECK([for pid_t], ac_cv_have_pid_t, [
2487         AC_TRY_COMPILE(
2488                 [
2489 #include <sys/types.h>
2490                 ],
2491                 [ pid_t foo; foo = 1235; ],
2492                 [ ac_cv_have_pid_t="yes" ],
2493                 [ ac_cv_have_pid_t="no" ]
2494         )
2495 ])
2496 if test "x$ac_cv_have_pid_t" = "xyes" ; then
2497         AC_DEFINE(HAVE_PID_T, 1, [define if you have pid_t data type])
2498 fi
2499
2500 AC_CACHE_CHECK([for mode_t], ac_cv_have_mode_t, [
2501         AC_TRY_COMPILE(
2502                 [
2503 #include <sys/types.h>
2504                 ],
2505                 [ mode_t foo; foo = 1235; ],
2506                 [ ac_cv_have_mode_t="yes" ],
2507                 [ ac_cv_have_mode_t="no" ]
2508         )
2509 ])
2510 if test "x$ac_cv_have_mode_t" = "xyes" ; then
2511         AC_DEFINE(HAVE_MODE_T, 1, [define if you have mode_t data type])
2512 fi
2513
2514
2515 AC_CACHE_CHECK([for struct sockaddr_storage], ac_cv_have_struct_sockaddr_storage, [
2516         AC_TRY_COMPILE(
2517                 [
2518 #include <sys/types.h>
2519 #include <sys/socket.h>
2520                 ],
2521                 [ struct sockaddr_storage s; ],
2522                 [ ac_cv_have_struct_sockaddr_storage="yes" ],
2523                 [ ac_cv_have_struct_sockaddr_storage="no" ]
2524         )
2525 ])
2526 if test "x$ac_cv_have_struct_sockaddr_storage" = "xyes" ; then
2527         AC_DEFINE(HAVE_STRUCT_SOCKADDR_STORAGE, 1,
2528                 [define if you have struct sockaddr_storage data type])
2529 fi
2530
2531 AC_CACHE_CHECK([for struct sockaddr_in6], ac_cv_have_struct_sockaddr_in6, [
2532         AC_TRY_COMPILE(
2533                 [
2534 #include <sys/types.h>
2535 #include <netinet/in.h>
2536                 ],
2537                 [ struct sockaddr_in6 s; s.sin6_family = 0; ],
2538                 [ ac_cv_have_struct_sockaddr_in6="yes" ],
2539                 [ ac_cv_have_struct_sockaddr_in6="no" ]
2540         )
2541 ])
2542 if test "x$ac_cv_have_struct_sockaddr_in6" = "xyes" ; then
2543         AC_DEFINE(HAVE_STRUCT_SOCKADDR_IN6, 1,
2544                 [define if you have struct sockaddr_in6 data type])
2545 fi
2546
2547 AC_CACHE_CHECK([for struct in6_addr], ac_cv_have_struct_in6_addr, [
2548         AC_TRY_COMPILE(
2549                 [
2550 #include <sys/types.h>
2551 #include <netinet/in.h>
2552                 ],
2553                 [ struct in6_addr s; s.s6_addr[0] = 0; ],
2554                 [ ac_cv_have_struct_in6_addr="yes" ],
2555                 [ ac_cv_have_struct_in6_addr="no" ]
2556         )
2557 ])
2558 if test "x$ac_cv_have_struct_in6_addr" = "xyes" ; then
2559         AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1,
2560                 [define if you have struct in6_addr data type])
2561 fi
2562
2563 AC_CACHE_CHECK([for struct addrinfo], ac_cv_have_struct_addrinfo, [
2564         AC_TRY_COMPILE(
2565                 [
2566 #include <sys/types.h>
2567 #include <sys/socket.h>
2568 #include <netdb.h>
2569                 ],
2570                 [ struct addrinfo s; s.ai_flags = AI_PASSIVE; ],
2571                 [ ac_cv_have_struct_addrinfo="yes" ],
2572                 [ ac_cv_have_struct_addrinfo="no" ]
2573         )
2574 ])
2575 if test "x$ac_cv_have_struct_addrinfo" = "xyes" ; then
2576         AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1,
2577                 [define if you have struct addrinfo data type])
2578 fi
2579
2580 AC_CACHE_CHECK([for struct timeval], ac_cv_have_struct_timeval, [
2581         AC_TRY_COMPILE(
2582                 [ #include <sys/time.h> ],
2583                 [ struct timeval tv; tv.tv_sec = 1;],
2584                 [ ac_cv_have_struct_timeval="yes" ],
2585                 [ ac_cv_have_struct_timeval="no" ]
2586         )
2587 ])
2588 if test "x$ac_cv_have_struct_timeval" = "xyes" ; then
2589         AC_DEFINE(HAVE_STRUCT_TIMEVAL, 1, [define if you have struct timeval])
2590         have_struct_timeval=1
2591 fi
2592
2593 AC_CHECK_TYPES(struct timespec)
2594
2595 # We need int64_t or else certian parts of the compile will fail.
2596 if test "x$ac_cv_have_int64_t" = "xno" && \
2597         test "x$ac_cv_sizeof_long_int" != "x8" && \
2598         test "x$ac_cv_sizeof_long_long_int" = "x0" ; then
2599         echo "OpenSSH requires int64_t support.  Contact your vendor or install"
2600         echo "an alternative compiler (I.E., GCC) before continuing."
2601         echo ""
2602         exit 1;
2603 else
2604 dnl test snprintf (broken on SCO w/gcc)
2605         AC_RUN_IFELSE(
2606                 [AC_LANG_SOURCE([[
2607 #include <stdio.h>
2608 #include <string.h>
2609 #ifdef HAVE_SNPRINTF
2610 main()
2611 {
2612         char buf[50];
2613         char expected_out[50];
2614         int mazsize = 50 ;
2615 #if (SIZEOF_LONG_INT == 8)
2616         long int num = 0x7fffffffffffffff;
2617 #else
2618         long long num = 0x7fffffffffffffffll;
2619 #endif
2620         strcpy(expected_out, "9223372036854775807");
2621         snprintf(buf, mazsize, "%lld", num);
2622         if(strcmp(buf, expected_out) != 0)
2623                 exit(1);
2624         exit(0);
2625 }
2626 #else
2627 main() { exit(0); }
2628 #endif
2629                 ]])], [ true ], [ AC_DEFINE(BROKEN_SNPRINTF) ],
2630                 AC_MSG_WARN([cross compiling: Assuming working snprintf()])
2631         )
2632 fi
2633
2634 dnl Checks for structure members
2635 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmp.h, HAVE_HOST_IN_UTMP)
2636 OSSH_CHECK_HEADER_FOR_FIELD(ut_host, utmpx.h, HAVE_HOST_IN_UTMPX)
2637 OSSH_CHECK_HEADER_FOR_FIELD(syslen, utmpx.h, HAVE_SYSLEN_IN_UTMPX)
2638 OSSH_CHECK_HEADER_FOR_FIELD(ut_pid, utmp.h, HAVE_PID_IN_UTMP)
2639 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmp.h, HAVE_TYPE_IN_UTMP)
2640 OSSH_CHECK_HEADER_FOR_FIELD(ut_type, utmpx.h, HAVE_TYPE_IN_UTMPX)
2641 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmp.h, HAVE_TV_IN_UTMP)
2642 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmp.h, HAVE_ID_IN_UTMP)
2643 OSSH_CHECK_HEADER_FOR_FIELD(ut_id, utmpx.h, HAVE_ID_IN_UTMPX)
2644 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmp.h, HAVE_ADDR_IN_UTMP)
2645 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr, utmpx.h, HAVE_ADDR_IN_UTMPX)
2646 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmp.h, HAVE_ADDR_V6_IN_UTMP)
2647 OSSH_CHECK_HEADER_FOR_FIELD(ut_addr_v6, utmpx.h, HAVE_ADDR_V6_IN_UTMPX)
2648 OSSH_CHECK_HEADER_FOR_FIELD(ut_exit, utmp.h, HAVE_EXIT_IN_UTMP)
2649 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmp.h, HAVE_TIME_IN_UTMP)
2650 OSSH_CHECK_HEADER_FOR_FIELD(ut_time, utmpx.h, HAVE_TIME_IN_UTMPX)
2651 OSSH_CHECK_HEADER_FOR_FIELD(ut_tv, utmpx.h, HAVE_TV_IN_UTMPX)
2652
2653 AC_CHECK_MEMBERS([struct stat.st_blksize])
2654 AC_CHECK_MEMBER([struct __res_state.retrans], [], [AC_DEFINE(__res_state, state,
2655         [Define if we don't have struct __res_state in resolv.h])],
2656 [
2657 #include <stdio.h>
2658 #if HAVE_SYS_TYPES_H
2659 # include <sys/types.h>
2660 #endif
2661 #include <netinet/in.h>
2662 #include <arpa/nameser.h>
2663 #include <resolv.h>
2664 ])
2665
2666 AC_CACHE_CHECK([for ss_family field in struct sockaddr_storage],
2667                 ac_cv_have_ss_family_in_struct_ss, [
2668         AC_TRY_COMPILE(
2669                 [
2670 #include <sys/types.h>
2671 #include <sys/socket.h>
2672                 ],
2673                 [ struct sockaddr_storage s; s.ss_family = 1; ],
2674                 [ ac_cv_have_ss_family_in_struct_ss="yes" ],
2675                 [ ac_cv_have_ss_family_in_struct_ss="no" ],
2676         )
2677 ])
2678 if test "x$ac_cv_have_ss_family_in_struct_ss" = "xyes" ; then
2679         AC_DEFINE(HAVE_SS_FAMILY_IN_SS, 1, [Fields in struct sockaddr_storage])
2680 fi
2681
2682 AC_CACHE_CHECK([for __ss_family field in struct sockaddr_storage],
2683                 ac_cv_have___ss_family_in_struct_ss, [
2684         AC_TRY_COMPILE(
2685                 [
2686 #include <sys/types.h>
2687 #include <sys/socket.h>
2688                 ],
2689                 [ struct sockaddr_storage s; s.__ss_family = 1; ],
2690                 [ ac_cv_have___ss_family_in_struct_ss="yes" ],
2691                 [ ac_cv_have___ss_family_in_struct_ss="no" ]
2692         )
2693 ])
2694 if test "x$ac_cv_have___ss_family_in_struct_ss" = "xyes" ; then
2695         AC_DEFINE(HAVE___SS_FAMILY_IN_SS, 1,
2696                 [Fields in struct sockaddr_storage])
2697 fi
2698
2699 AC_CACHE_CHECK([for pw_class field in struct passwd],
2700                 ac_cv_have_pw_class_in_struct_passwd, [
2701         AC_TRY_COMPILE(
2702                 [
2703 #include <pwd.h>
2704                 ],
2705                 [ struct passwd p; p.pw_class = 0; ],
2706                 [ ac_cv_have_pw_class_in_struct_passwd="yes" ],
2707                 [ ac_cv_have_pw_class_in_struct_passwd="no" ]
2708         )
2709 ])
2710 if test "x$ac_cv_have_pw_class_in_struct_passwd" = "xyes" ; then
2711         AC_DEFINE(HAVE_PW_CLASS_IN_PASSWD, 1,
2712                 [Define if your password has a pw_class field])
2713 fi
2714
2715 AC_CACHE_CHECK([for pw_expire field in struct passwd],
2716                 ac_cv_have_pw_expire_in_struct_passwd, [
2717         AC_TRY_COMPILE(
2718                 [
2719 #include <pwd.h>
2720                 ],
2721                 [ struct passwd p; p.pw_expire = 0; ],
2722                 [ ac_cv_have_pw_expire_in_struct_passwd="yes" ],
2723                 [ ac_cv_have_pw_expire_in_struct_passwd="no" ]
2724         )
2725 ])
2726 if test "x$ac_cv_have_pw_expire_in_struct_passwd" = "xyes" ; then
2727         AC_DEFINE(HAVE_PW_EXPIRE_IN_PASSWD, 1,
2728                 [Define if your password has a pw_expire field])
2729 fi
2730
2731 AC_CACHE_CHECK([for pw_change field in struct passwd],
2732                 ac_cv_have_pw_change_in_struct_passwd, [
2733         AC_TRY_COMPILE(
2734                 [
2735 #include <pwd.h>
2736                 ],
2737                 [ struct passwd p; p.pw_change = 0; ],
2738                 [ ac_cv_have_pw_change_in_struct_passwd="yes" ],
2739                 [ ac_cv_have_pw_change_in_struct_passwd="no" ]
2740         )
2741 ])
2742 if test "x$ac_cv_have_pw_change_in_struct_passwd" = "xyes" ; then
2743         AC_DEFINE(HAVE_PW_CHANGE_IN_PASSWD, 1,
2744                 [Define if your password has a pw_change field])
2745 fi
2746
2747 dnl make sure we're using the real structure members and not defines
2748 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],
2749                 ac_cv_have_accrights_in_msghdr, [
2750         AC_COMPILE_IFELSE(
2751                 [
2752 #include <sys/types.h>
2753 #include <sys/socket.h>
2754 #include <sys/uio.h>
2755 int main() {
2756 #ifdef msg_accrights
2757 #error "msg_accrights is a macro"
2758 exit(1);
2759 #endif
2760 struct msghdr m;
2761 m.msg_accrights = 0;
2762 exit(0);
2763 }
2764                 ],
2765                 [ ac_cv_have_accrights_in_msghdr="yes" ],
2766                 [ ac_cv_have_accrights_in_msghdr="no" ]
2767         )
2768 ])
2769 if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
2770         AC_DEFINE(HAVE_ACCRIGHTS_IN_MSGHDR, 1,
2771                 [Define if your system uses access rights style
2772                 file descriptor passing])
2773 fi
2774
2775 AC_CACHE_CHECK([for msg_control field in struct msghdr],
2776                 ac_cv_have_control_in_msghdr, [
2777         AC_COMPILE_IFELSE(
2778                 [
2779 #include <sys/types.h>
2780 #include <sys/socket.h>
2781 #include <sys/uio.h>
2782 int main() {
2783 #ifdef msg_control
2784 #error "msg_control is a macro"
2785 exit(1);
2786 #endif
2787 struct msghdr m;
2788 m.msg_control = 0;
2789 exit(0);
2790 }
2791                 ],
2792                 [ ac_cv_have_control_in_msghdr="yes" ],
2793                 [ ac_cv_have_control_in_msghdr="no" ]
2794         )
2795 ])
2796 if test "x$ac_cv_have_control_in_msghdr" = "xyes" ; then
2797         AC_DEFINE(HAVE_CONTROL_IN_MSGHDR, 1,
2798                 [Define if your system uses ancillary data style
2799                 file descriptor passing])
2800 fi
2801
2802 AC_CACHE_CHECK([if libc defines __progname], ac_cv_libc_defines___progname, [
2803         AC_TRY_LINK([],
2804                 [ extern char *__progname; printf("%s", __progname); ],
2805                 [ ac_cv_libc_defines___progname="yes" ],
2806                 [ ac_cv_libc_defines___progname="no" ]
2807         )
2808 ])
2809 if test "x$ac_cv_libc_defines___progname" = "xyes" ; then
2810         AC_DEFINE(HAVE___PROGNAME, 1, [Define if libc defines __progname])
2811 fi
2812
2813 AC_CACHE_CHECK([whether $CC implements __FUNCTION__], ac_cv_cc_implements___FUNCTION__, [
2814         AC_TRY_LINK([
2815 #include <stdio.h>
2816 ],
2817                 [ printf("%s", __FUNCTION__); ],
2818                 [ ac_cv_cc_implements___FUNCTION__="yes" ],
2819                 [ ac_cv_cc_implements___FUNCTION__="no" ]
2820         )
2821 ])
2822 if test "x$ac_cv_cc_implements___FUNCTION__" = "xyes" ; then
2823         AC_DEFINE(HAVE___FUNCTION__, 1,
2824                 [Define if compiler implements __FUNCTION__])
2825 fi
2826
2827 AC_CACHE_CHECK([whether $CC implements __func__], ac_cv_cc_implements___func__, [
2828         AC_TRY_LINK([
2829 #include <stdio.h>
2830 ],
2831                 [ printf("%s", __func__); ],
2832                 [ ac_cv_cc_implements___func__="yes" ],
2833                 [ ac_cv_cc_implements___func__="no" ]
2834         )
2835 ])
2836 if test "x$ac_cv_cc_implements___func__" = "xyes" ; then
2837         AC_DEFINE(HAVE___func__, 1, [Define if compiler implements __func__])
2838 fi
2839
2840 AC_CACHE_CHECK([whether va_copy exists], ac_cv_have_va_copy, [
2841         AC_TRY_LINK(
2842                 [#include <stdarg.h>
2843                  va_list x,y;],
2844                 [va_copy(x,y);],
2845                 [ ac_cv_have_va_copy="yes" ],
2846                 [ ac_cv_have_va_copy="no" ]
2847         )
2848 ])
2849 if test "x$ac_cv_have_va_copy" = "xyes" ; then
2850         AC_DEFINE(HAVE_VA_COPY, 1, [Define if va_copy exists])
2851 fi
2852
2853 AC_CACHE_CHECK([whether __va_copy exists], ac_cv_have___va_copy, [
2854         AC_TRY_LINK(
2855                 [#include <stdarg.h>
2856                  va_list x,y;],
2857                 [__va_copy(x,y);],
2858                 [ ac_cv_have___va_copy="yes" ],
2859                 [ ac_cv_have___va_copy="no" ]
2860         )
2861 ])
2862 if test "x$ac_cv_have___va_copy" = "xyes" ; then
2863         AC_DEFINE(HAVE___VA_COPY, 1, [Define if __va_copy exists])
2864 fi
2865
2866 AC_CACHE_CHECK([whether getopt has optreset support],
2867                 ac_cv_have_getopt_optreset, [
2868         AC_TRY_LINK(
2869                 [
2870 #include <getopt.h>
2871                 ],
2872                 [ extern int optreset; optreset = 0; ],
2873                 [ ac_cv_have_getopt_optreset="yes" ],
2874                 [ ac_cv_have_getopt_optreset="no" ]
2875         )
2876 ])
2877 if test "x$ac_cv_have_getopt_optreset" = "xyes" ; then
2878         AC_DEFINE(HAVE_GETOPT_OPTRESET, 1,
2879                 [Define if your getopt(3) defines and uses optreset])
2880 fi
2881
2882 AC_CACHE_CHECK([if libc defines sys_errlist], ac_cv_libc_defines_sys_errlist, [
2883         AC_TRY_LINK([],
2884                 [ extern const char *const sys_errlist[]; printf("%s", sys_errlist[0]);],
2885                 [ ac_cv_libc_defines_sys_errlist="yes" ],
2886                 [ ac_cv_libc_defines_sys_errlist="no" ]
2887         )
2888 ])
2889 if test "x$ac_cv_libc_defines_sys_errlist" = "xyes" ; then
2890         AC_DEFINE(HAVE_SYS_ERRLIST, 1,
2891                 [Define if your system defines sys_errlist[]])
2892 fi
2893
2894
2895 AC_CACHE_CHECK([if libc defines sys_nerr], ac_cv_libc_defines_sys_nerr, [
2896         AC_TRY_LINK([],
2897                 [ extern int sys_nerr; printf("%i", sys_nerr);],
2898                 [ ac_cv_libc_defines_sys_nerr="yes" ],
2899                 [ ac_cv_libc_defines_sys_nerr="no" ]
2900         )
2901 ])
2902 if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
2903         AC_DEFINE(HAVE_SYS_NERR, 1, [Define if your system defines sys_nerr])
2904 fi
2905
2906 SCARD_MSG="no"
2907 # Check whether user wants sectok support
2908 AC_ARG_WITH(sectok,
2909         [  --with-sectok           Enable smartcard support using libsectok],
2910         [
2911                 if test "x$withval" != "xno" ; then
2912                         if test "x$withval" != "xyes" ; then
2913                                 CPPFLAGS="$CPPFLAGS -I${withval}"
2914                                 LDFLAGS="$LDFLAGS -L${withval}"
2915                                 if test ! -z "$need_dash_r" ; then
2916                                         LDFLAGS="$LDFLAGS -R${withval}"
2917                                 fi
2918                                 if test ! -z "$blibpath" ; then
2919                                         blibpath="$blibpath:${withval}"
2920                                 fi
2921                         fi
2922                         AC_CHECK_HEADERS(sectok.h)
2923                         if test "$ac_cv_header_sectok_h" != yes; then
2924                                 AC_MSG_ERROR(Can't find sectok.h)
2925                         fi
2926                         AC_CHECK_LIB(sectok, sectok_open)
2927                         if test "$ac_cv_lib_sectok_sectok_open" != yes; then
2928                                 AC_MSG_ERROR(Can't find libsectok)
2929                         fi
2930                         AC_DEFINE(SMARTCARD, 1,
2931                                 [Define if you want smartcard support])
2932                         AC_DEFINE(USE_SECTOK, 1,
2933                                 [Define if you want smartcard support
2934                                 using sectok])
2935                         SCARD_MSG="yes, using sectok"
2936                 fi
2937         ]
2938 )
2939
2940 # Check whether user wants OpenSC support
2941 OPENSC_CONFIG="no"
2942 AC_ARG_WITH(opensc,
2943         [  --with-opensc[[=PFX]]     Enable smartcard support using OpenSC (optionally in PATH)],
2944         [
2945             if test "x$withval" != "xno" ; then
2946                 if test "x$withval" != "xyes" ; then
2947                         OPENSC_CONFIG=$withval/bin/opensc-config
2948                 else
2949                         AC_PATH_PROG(OPENSC_CONFIG, opensc-config, no)
2950                 fi
2951                 if test "$OPENSC_CONFIG" != "no"; then
2952                         LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
2953                         LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
2954                         CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
2955                         LDFLAGS="$LDFLAGS $LIBOPENSC_LIBS"
2956                         AC_DEFINE(SMARTCARD)
2957                         AC_DEFINE(USE_OPENSC, 1,
2958                                 [Define if you want smartcard support
2959                                 using OpenSC])
2960                         SCARD_MSG="yes, using OpenSC"
2961                 fi
2962             fi
2963         ]
2964 )
2965
2966 # Check libraries needed by DNS fingerprint support
2967 AC_SEARCH_LIBS(getrrsetbyname, resolv,
2968         [AC_DEFINE(HAVE_GETRRSETBYNAME, 1,
2969                 [Define if getrrsetbyname() exists])],
2970         [
2971                 # Needed by our getrrsetbyname()
2972                 AC_SEARCH_LIBS(res_query, resolv)
2973                 AC_SEARCH_LIBS(dn_expand, resolv)
2974                 AC_MSG_CHECKING(if res_query will link)
2975                 AC_TRY_LINK_FUNC(res_query, AC_MSG_RESULT(yes),
2976                    [AC_MSG_RESULT(no)
2977                     saved_LIBS="$LIBS"
2978                     LIBS="$LIBS -lresolv"
2979                     AC_MSG_CHECKING(for res_query in -lresolv)
2980                     AC_LINK_IFELSE([
2981 #include <resolv.h>
2982 int main()
2983 {
2984         res_query (0, 0, 0, 0, 0);
2985         return 0;
2986 }
2987                         ],
2988                         [LIBS="$LIBS -lresolv"
2989                          AC_MSG_RESULT(yes)],
2990                         [LIBS="$saved_LIBS"
2991                          AC_MSG_RESULT(no)])
2992                     ])
2993                 AC_CHECK_FUNCS(_getshort _getlong)
2994                 AC_CHECK_DECLS([_getshort, _getlong], , ,
2995                     [#include <sys/types.h>
2996                     #include <arpa/nameser.h>])
2997                 AC_CHECK_MEMBER(HEADER.ad,
2998                         [AC_DEFINE(HAVE_HEADER_AD, 1,
2999                             [Define if HEADER.ad exists in arpa/nameser.h])],,
3000                         [#include <arpa/nameser.h>])
3001         ])
3002
3003 # Check whether user wants SELinux support
3004 SELINUX_MSG="no"
3005 LIBSELINUX=""
3006 AC_ARG_WITH(selinux,
3007         [  --with-selinux   Enable SELinux support],
3008         [ if test "x$withval" != "xno" ; then
3009                 AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
3010                 SELINUX_MSG="yes"
3011                 AC_CHECK_HEADER([selinux/selinux.h], ,
3012                     AC_MSG_ERROR(SELinux support requires selinux.h header))
3013                 AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
3014                     AC_MSG_ERROR(SELinux support requires libselinux library))
3015                 AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
3016         fi ]
3017 )
3018 AC_SUBST(LIBSELINUX)
3019
3020 # Check whether user wants Kerberos 5 support
3021 KRB5_MSG="no"
3022 AC_ARG_WITH(kerberos5,
3023         [  --with-kerberos5=PATH   Enable Kerberos 5 support],
3024         [ if test "x$withval" != "xno" ; then
3025                 if test "x$withval" = "xyes" ; then
3026                         KRB5ROOT="/usr/local"
3027                 else
3028                         KRB5ROOT=${withval}
3029                 fi
3030
3031                 AC_DEFINE(KRB5, 1, [Define if you want Kerberos 5 support])
3032                 KRB5_MSG="yes"
3033
3034                 AC_MSG_CHECKING(for krb5-config)
3035                 if test -x  $KRB5ROOT/bin/krb5-config ; then
3036                         KRB5CONF=$KRB5ROOT/bin/krb5-config
3037                         AC_MSG_RESULT($KRB5CONF)
3038
3039                         AC_MSG_CHECKING(for gssapi support)
3040                         if $KRB5CONF | grep gssapi >/dev/null ; then
3041                                 AC_MSG_RESULT(yes)
3042                                 AC_DEFINE(GSSAPI, 1,
3043                                         [Define this if you want GSSAPI
3044                                         support in the version 2 protocol])
3045                                 k5confopts=gssapi
3046                         else
3047                                 AC_MSG_RESULT(no)
3048                                 k5confopts=""
3049                         fi
3050                         K5CFLAGS="`$KRB5CONF --cflags $k5confopts`"
3051                         K5LIBS="`$KRB5CONF --libs $k5confopts`"
3052                         CPPFLAGS="$CPPFLAGS $K5CFLAGS"
3053                         AC_MSG_CHECKING(whether we are using Heimdal)
3054                         AC_TRY_COMPILE([ #include <krb5.h> ],
3055                                        [ char *tmp = heimdal_version; ],
3056                                        [ AC_MSG_RESULT(yes)
3057                                          AC_DEFINE(HEIMDAL, 1,
3058                                         [Define this if you are using the
3059                                         Heimdal version of Kerberos V5]) ],
3060                                          AC_MSG_RESULT(no)
3061                         )
3062                 else
3063                         AC_MSG_RESULT(no)
3064                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include"
3065                         LDFLAGS="$LDFLAGS -L${KRB5ROOT}/lib"
3066                         AC_MSG_CHECKING(whether we are using Heimdal)
3067                         AC_TRY_COMPILE([ #include <krb5.h> ],
3068                                        [ char *tmp = heimdal_version; ],
3069                                        [ AC_MSG_RESULT(yes)
3070                                          AC_DEFINE(HEIMDAL)
3071                                          K5LIBS="-lkrb5 -ldes"
3072                                          K5LIBS="$K5LIBS -lcom_err -lasn1"
3073                                          AC_CHECK_LIB(roken, net_write,
3074                                            [K5LIBS="$K5LIBS -lroken"])
3075                                        ],
3076                                        [ AC_MSG_RESULT(no)
3077                                          K5LIBS="-lkrb5 -lk5crypto -lcom_err"
3078                                        ]
3079                         )
3080                         AC_SEARCH_LIBS(dn_expand, resolv)
3081
3082                         AC_CHECK_LIB(gssapi,gss_init_sec_context,
3083                                 [ AC_DEFINE(GSSAPI)
3084                                   K5LIBS="-lgssapi $K5LIBS" ],
3085                                 [ AC_CHECK_LIB(gssapi_krb5,gss_init_sec_context,
3086                                         [ AC_DEFINE(GSSAPI)
3087                                           K5LIBS="-lgssapi_krb5 $K5LIBS" ],
3088                                         AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]),
3089                                         $K5LIBS)
3090                                 ],
3091                                 $K5LIBS)
3092
3093                         AC_CHECK_HEADER(gssapi.h, ,
3094                                 [ unset ac_cv_header_gssapi_h
3095                                   CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3096                                   AC_CHECK_HEADERS(gssapi.h, ,
3097                                         AC_MSG_WARN([Cannot find any suitable gss-api header - build may fail])
3098                                   )
3099                                 ]
3100                         )
3101
3102                         oldCPP="$CPPFLAGS"
3103                         CPPFLAGS="$CPPFLAGS -I${KRB5ROOT}/include/gssapi"
3104                         AC_CHECK_HEADER(gssapi_krb5.h, ,
3105                                         [ CPPFLAGS="$oldCPP" ])
3106
3107                 fi
3108                 if test ! -z "$need_dash_r" ; then
3109                         LDFLAGS="$LDFLAGS -R${KRB5ROOT}/lib"
3110                 fi
3111                 if test ! -z "$blibpath" ; then
3112                         blibpath="$blibpath:${KRB5ROOT}/lib"
3113                 fi
3114
3115                 AC_CHECK_HEADERS(gssapi.h gssapi/gssapi.h)
3116                 AC_CHECK_HEADERS(gssapi_krb5.h gssapi/gssapi_krb5.h)
3117                 AC_CHECK_HEADERS(gssapi_generic.h gssapi/gssapi_generic.h)
3118
3119                 LIBS="$LIBS $K5LIBS"
3120                 AC_SEARCH_LIBS(k_hasafs, kafs, AC_DEFINE(USE_AFS, 1,
3121                         [Define this if you want to use libkafs' AFS support]))
3122         fi
3123         ]
3124 )
3125
3126 # Looking for programs, paths and files
3127
3128 PRIVSEP_PATH=/var/empty
3129 AC_ARG_WITH(privsep-path,
3130         [  --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty)],
3131         [
3132                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3133                     test "x${withval}" != "xyes"; then
3134                         PRIVSEP_PATH=$withval
3135                 fi
3136         ]
3137 )
3138 AC_SUBST(PRIVSEP_PATH)
3139
3140 AC_ARG_WITH(xauth,
3141         [  --with-xauth=PATH       Specify path to xauth program ],
3142         [
3143                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3144                     test "x${withval}" != "xyes"; then
3145                         xauth_path=$withval
3146                 fi
3147         ],
3148         [
3149                 TestPath="$PATH"
3150                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X/bin"
3151                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/bin/X11"
3152                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/X11R6/bin"
3153                 TestPath="${TestPath}${PATH_SEPARATOR}/usr/openwin/bin"
3154                 AC_PATH_PROG(xauth_path, xauth, , $TestPath)
3155                 if (test ! -z "$xauth_path" && test -x "/usr/openwin/bin/xauth") ; then
3156                         xauth_path="/usr/openwin/bin/xauth"
3157                 fi
3158         ]
3159 )
3160
3161 STRIP_OPT=-s
3162 AC_ARG_ENABLE(strip,
3163         [  --disable-strip         Disable calling strip(1) on install],
3164         [
3165                 if test "x$enableval" = "xno" ; then
3166                         STRIP_OPT=
3167                 fi
3168         ]
3169 )
3170 AC_SUBST(STRIP_OPT)
3171
3172 if test -z "$xauth_path" ; then
3173         XAUTH_PATH="undefined"
3174         AC_SUBST(XAUTH_PATH)
3175 else
3176         AC_DEFINE_UNQUOTED(XAUTH_PATH, "$xauth_path",
3177                 [Define if xauth is found in your path])
3178         XAUTH_PATH=$xauth_path
3179         AC_SUBST(XAUTH_PATH)
3180 fi
3181
3182 # Check for mail directory (last resort if we cannot get it from headers)
3183 if test ! -z "$MAIL" ; then
3184         maildir=`dirname $MAIL`
3185         AC_DEFINE_UNQUOTED(MAIL_DIRECTORY, "$maildir",
3186                 [Set this to your mail directory if you don't have maillock.h])
3187 fi
3188
3189 if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes"; then
3190         AC_MSG_WARN([cross compiling: Disabling /dev/ptmx test])
3191         disable_ptmx_check=yes
3192 fi
3193 if test -z "$no_dev_ptmx" ; then
3194         if test "x$disable_ptmx_check" != "xyes" ; then
3195                 AC_CHECK_FILE("/dev/ptmx",
3196                         [
3197                                 AC_DEFINE_UNQUOTED(HAVE_DEV_PTMX, 1,
3198                                         [Define if you have /dev/ptmx])
3199                                 have_dev_ptmx=1
3200                         ]
3201                 )
3202         fi
3203 fi
3204
3205 if test ! -z "$cross_compiling" && test "x$cross_compiling" != "xyes"; then
3206         AC_CHECK_FILE("/dev/ptc",
3207                 [
3208                         AC_DEFINE_UNQUOTED(HAVE_DEV_PTS_AND_PTC, 1,
3209                                 [Define if you have /dev/ptc])
3210                         have_dev_ptc=1
3211                 ]
3212         )
3213 else
3214         AC_MSG_WARN([cross compiling: Disabling /dev/ptc test])
3215 fi
3216
3217 # Options from here on. Some of these are preset by platform above
3218 AC_ARG_WITH(mantype,
3219         [  --with-mantype=man|cat|doc  Set man page type],
3220         [
3221                 case "$withval" in
3222                 man|cat|doc)
3223                         MANTYPE=$withval
3224                         ;;
3225                 *)
3226                         AC_MSG_ERROR(invalid man type: $withval)
3227                         ;;
3228                 esac
3229         ]
3230 )
3231 if test -z "$MANTYPE"; then
3232         TestPath="/usr/bin${PATH_SEPARATOR}/usr/ucb"
3233         AC_PATH_PROGS(NROFF, nroff awf, /bin/false, $TestPath)
3234         if ${NROFF} -mdoc ${srcdir}/ssh.1 >/dev/null 2>&1; then
3235                 MANTYPE=doc
3236         elif ${NROFF} -man ${srcdir}/ssh.1 >/dev/null 2>&1; then
3237                 MANTYPE=man
3238         else
3239                 MANTYPE=cat
3240         fi
3241 fi
3242 AC_SUBST(MANTYPE)
3243 if test "$MANTYPE" = "doc"; then
3244         mansubdir=man;
3245 else
3246         mansubdir=$MANTYPE;
3247 fi
3248 AC_SUBST(mansubdir)
3249
3250 # Check whether to enable MD5 passwords
3251 MD5_MSG="no"
3252 AC_ARG_WITH(md5-passwords,
3253         [  --with-md5-passwords    Enable use of MD5 passwords],
3254         [
3255                 if test "x$withval" != "xno" ; then
3256                         AC_DEFINE(HAVE_MD5_PASSWORDS, 1,
3257                                 [Define if you want to allow MD5 passwords])
3258                         MD5_MSG="yes"
3259                 fi
3260         ]
3261 )
3262
3263 # Whether to disable shadow password support
3264 AC_ARG_WITH(shadow,
3265         [  --without-shadow        Disable shadow password support],
3266         [
3267                 if test "x$withval" = "xno" ; then
3268                         AC_DEFINE(DISABLE_SHADOW)
3269                         disable_shadow=yes
3270                 fi
3271         ]
3272 )
3273
3274 if test -z "$disable_shadow" ; then
3275         AC_MSG_CHECKING([if the systems has expire shadow information])
3276         AC_TRY_COMPILE(
3277         [
3278 #include <sys/types.h>
3279 #include <shadow.h>
3280         struct spwd sp;
3281         ],[ sp.sp_expire = sp.sp_lstchg = sp.sp_inact = 0; ],
3282         [ sp_expire_available=yes ], []
3283         )
3284
3285         if test "x$sp_expire_available" = "xyes" ; then
3286                 AC_MSG_RESULT(yes)
3287                 AC_DEFINE(HAS_SHADOW_EXPIRE, 1,
3288                     [Define if you want to use shadow password expire field])
3289         else
3290                 AC_MSG_RESULT(no)
3291         fi
3292 fi
3293
3294 # Use ip address instead of hostname in $DISPLAY
3295 if test ! -z "$IPADDR_IN_DISPLAY" ; then
3296         DISPLAY_HACK_MSG="yes"
3297         AC_DEFINE(IPADDR_IN_DISPLAY, 1,
3298                 [Define if you need to use IP address
3299                 instead of hostname in $DISPLAY])
3300 else
3301         DISPLAY_HACK_MSG="no"
3302         AC_ARG_WITH(ipaddr-display,
3303                 [  --with-ipaddr-display   Use ip address instead of hostname in \$DISPLAY],
3304                 [
3305                         if test "x$withval" != "xno" ; then
3306                                 AC_DEFINE(IPADDR_IN_DISPLAY)
3307                                 DISPLAY_HACK_MSG="yes"
3308                         fi
3309                 ]
3310         )
3311 fi
3312
3313 # check for /etc/default/login and use it if present.
3314 AC_ARG_ENABLE(etc-default-login,
3315         [  --disable-etc-default-login Disable using PATH from /etc/default/login [no]],
3316         [ if test "x$enableval" = "xno"; then
3317                 AC_MSG_NOTICE([/etc/default/login handling disabled])
3318                 etc_default_login=no
3319           else
3320                 etc_default_login=yes
3321           fi ],
3322         [ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
3323           then
3324                 AC_MSG_WARN([cross compiling: not checking /etc/default/login])
3325                 etc_default_login=no
3326           else
3327                 etc_default_login=yes
3328           fi ]
3329 )
3330
3331 if test "x$etc_default_login" != "xno"; then
3332         AC_CHECK_FILE("/etc/default/login",
3333             [ external_path_file=/etc/default/login ])
3334         if test "x$external_path_file" = "x/etc/default/login"; then
3335                 AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN, 1,
3336                         [Define if your system has /etc/default/login])
3337         fi
3338 fi
3339
3340 dnl BSD systems use /etc/login.conf so --with-default-path= has no effect
3341 if test $ac_cv_func_login_getcapbool = "yes" && \
3342         test $ac_cv_header_login_cap_h = "yes" ; then
3343         external_path_file=/etc/login.conf
3344 fi
3345
3346 # Whether to mess with the default path
3347 SERVER_PATH_MSG="(default)"
3348 AC_ARG_WITH(default-path,
3349         [  --with-default-path=    Specify default \$PATH environment for server],
3350         [
3351                 if test "x$external_path_file" = "x/etc/login.conf" ; then
3352                         AC_MSG_WARN([
3353 --with-default-path=PATH has no effect on this system.
3354 Edit /etc/login.conf instead.])
3355                 elif test "x$withval" != "xno" ; then
3356                         if test ! -z "$external_path_file" ; then
3357                                 AC_MSG_WARN([
3358 --with-default-path=PATH will only be used if PATH is not defined in
3359 $external_path_file .])
3360                         fi
3361                         user_path="$withval"
3362                         SERVER_PATH_MSG="$withval"
3363                 fi
3364         ],
3365         [ if test "x$external_path_file" = "x/etc/login.conf" ; then
3366                 AC_MSG_WARN([Make sure the path to scp is in /etc/login.conf])
3367         else
3368                 if test ! -z "$external_path_file" ; then
3369                         AC_MSG_WARN([
3370 If PATH is defined in $external_path_file, ensure the path to scp is included,
3371 otherwise scp will not work.])
3372                 fi
3373                 AC_RUN_IFELSE(
3374                         [AC_LANG_SOURCE([[
3375 /* find out what STDPATH is */
3376 #include <stdio.h>
3377 #ifdef HAVE_PATHS_H
3378 # include <paths.h>
3379 #endif
3380 #ifndef _PATH_STDPATH
3381 # ifdef _PATH_USERPATH  /* Irix */
3382 #  define _PATH_STDPATH _PATH_USERPATH
3383 # else
3384 #  define _PATH_STDPATH "/usr/bin:/bin:/usr/sbin:/sbin"
3385 # endif
3386 #endif
3387 #include <sys/types.h>
3388 #include <sys/stat.h>
3389 #include <fcntl.h>
3390 #define DATA "conftest.stdpath"
3391
3392 main()
3393 {
3394         FILE *fd;
3395         int rc;
3396
3397         fd = fopen(DATA,"w");
3398         if(fd == NULL)
3399                 exit(1);
3400
3401         if ((rc = fprintf(fd,"%s", _PATH_STDPATH)) < 0)
3402                 exit(1);
3403
3404         exit(0);
3405 }
3406                 ]])],
3407                 [ user_path=`cat conftest.stdpath` ],
3408                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
3409                 [ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
3410         )
3411 # make sure $bindir is in USER_PATH so scp will work
3412                 t_bindir=`eval echo ${bindir}`
3413                 case $t_bindir in
3414                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$prefix~"` ;;
3415                 esac
3416                 case $t_bindir in
3417                         NONE/*) t_bindir=`echo $t_bindir | sed "s~NONE~$ac_default_prefix~"` ;;
3418                 esac
3419                 echo $user_path | grep ":$t_bindir"  > /dev/null 2>&1
3420                 if test $? -ne 0  ; then
3421                         echo $user_path | grep "^$t_bindir"  > /dev/null 2>&1
3422                         if test $? -ne 0  ; then
3423                                 user_path=$user_path:$t_bindir
3424                                 AC_MSG_RESULT(Adding $t_bindir to USER_PATH so scp will work)
3425                         fi
3426                 fi
3427         fi ]
3428 )
3429 if test "x$external_path_file" != "x/etc/login.conf" ; then
3430         AC_DEFINE_UNQUOTED(USER_PATH, "$user_path", [Specify default $PATH])
3431         AC_SUBST(user_path)
3432 fi
3433
3434 # Set superuser path separately to user path
3435 AC_ARG_WITH(superuser-path,
3436         [  --with-superuser-path=  Specify different path for super-user],
3437         [
3438                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3439                     test "x${withval}" != "xyes"; then
3440                         AC_DEFINE_UNQUOTED(SUPERUSER_PATH, "$withval",
3441                                 [Define if you want a different $PATH
3442                                 for the superuser])
3443                         superuser_path=$withval
3444                 fi
3445         ]
3446 )
3447
3448
3449 AC_MSG_CHECKING([if we need to convert IPv4 in IPv6-mapped addresses])
3450 IPV4_IN6_HACK_MSG="no"
3451 AC_ARG_WITH(4in6,
3452         [  --with-4in6             Check for and convert IPv4 in IPv6 mapped addresses],
3453         [
3454                 if test "x$withval" != "xno" ; then
3455                         AC_MSG_RESULT(yes)
3456                         AC_DEFINE(IPV4_IN_IPV6, 1,
3457                                 [Detect IPv4 in IPv6 mapped addresses
3458                                 and treat as IPv4])
3459                         IPV4_IN6_HACK_MSG="yes"
3460                 else
3461                         AC_MSG_RESULT(no)
3462                 fi
3463         ],[
3464                 if test "x$inet6_default_4in6" = "xyes"; then
3465                         AC_MSG_RESULT([yes (default)])
3466                         AC_DEFINE(IPV4_IN_IPV6)
3467                         IPV4_IN6_HACK_MSG="yes"
3468                 else
3469                         AC_MSG_RESULT([no (default)])
3470                 fi
3471         ]
3472 )
3473
3474 # Whether to enable BSD auth support
3475 BSD_AUTH_MSG=no
3476 AC_ARG_WITH(bsd-auth,
3477         [  --with-bsd-auth         Enable BSD auth support],
3478         [
3479                 if test "x$withval" != "xno" ; then
3480                         AC_DEFINE(BSD_AUTH, 1,
3481                                 [Define if you have BSD auth support])
3482                         BSD_AUTH_MSG=yes
3483                 fi
3484         ]
3485 )
3486
3487 # Where to place sshd.pid
3488 piddir=/var/run
3489 # make sure the directory exists
3490 if test ! -d $piddir ; then
3491         piddir=`eval echo ${sysconfdir}`
3492         case $piddir in
3493                 NONE/*) piddir=`echo $piddir | sed "s~NONE~$ac_default_prefix~"` ;;
3494         esac
3495 fi
3496
3497 AC_ARG_WITH(pid-dir,
3498         [  --with-pid-dir=PATH     Specify location of ssh.pid file],
3499         [
3500                 if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
3501                     test "x${withval}" != "xyes"; then
3502                         piddir=$withval
3503                         if test ! -d $piddir ; then
3504                         AC_MSG_WARN([** no $piddir directory on this system **])
3505                         fi
3506                 fi
3507         ]
3508 )
3509
3510 AC_DEFINE_UNQUOTED(_PATH_SSH_PIDDIR, "$piddir", [Specify location of ssh.pid])
3511 AC_SUBST(piddir)
3512
3513 dnl allow user to disable some login recording features
3514 AC_ARG_ENABLE(lastlog,
3515         [  --disable-lastlog       disable use of lastlog even if detected [no]],
3516         [
3517                 if test "x$enableval" = "xno" ; then
3518                         AC_DEFINE(DISABLE_LASTLOG)
3519                 fi
3520         ]
3521 )
3522 AC_ARG_ENABLE(utmp,
3523         [  --disable-utmp          disable use of utmp even if detected [no]],
3524         [
3525                 if test "x$enableval" = "xno" ; then
3526                         AC_DEFINE(DISABLE_UTMP)
3527                 fi
3528         ]
3529 )
3530 AC_ARG_ENABLE(utmpx,
3531         [  --disable-utmpx         disable use of utmpx even if detected [no]],
3532         [
3533                 if test "x$enableval" = "xno" ; then
3534                         AC_DEFINE(DISABLE_UTMPX, 1,
3535                                 [Define if you don't want to use utmpx])
3536                 fi
3537         ]
3538 )
3539 AC_ARG_ENABLE(wtmp,
3540         [  --disable-wtmp          disable use of wtmp even if detected [no]],
3541         [
3542                 if test "x$enableval" = "xno" ; then
3543                         AC_DEFINE(DISABLE_WTMP)
3544                 fi
3545         ]
3546 )
3547 AC_ARG_ENABLE(wtmpx,
3548         [  --disable-wtmpx         disable use of wtmpx even if detected [no]],
3549         [
3550                 if test "x$enableval" = "xno" ; then
3551                         AC_DEFINE(DISABLE_WTMPX, 1,
3552                                 [Define if you don't want to use wtmpx])
3553                 fi
3554         ]
3555 )
3556 AC_ARG_ENABLE(libutil,
3557         [  --disable-libutil       disable use of libutil (login() etc.) [no]],
3558         [
3559                 if test "x$enableval" = "xno" ; then
3560                         AC_DEFINE(DISABLE_LOGIN)
3561                 fi
3562         ]
3563 )
3564 AC_ARG_ENABLE(pututline,
3565         [  --disable-pututline     disable use of pututline() etc. ([uw]tmp) [no]],
3566         [
3567                 if test "x$enableval" = "xno" ; then
3568                         AC_DEFINE(DISABLE_PUTUTLINE, 1,
3569                                 [Define if you don't want to use pututline()
3570                                 etc. to write [uw]tmp])
3571                 fi
3572         ]
3573 )
3574 AC_ARG_ENABLE(pututxline,
3575         [  --disable-pututxline    disable use of pututxline() etc. ([uw]tmpx) [no]],
3576         [
3577                 if test "x$enableval" = "xno" ; then
3578                         AC_DEFINE(DISABLE_PUTUTXLINE, 1,
3579                                 [Define if you don't want to use pututxline()
3580                                 etc. to write [uw]tmpx])
3581                 fi
3582         ]
3583 )
3584 AC_ARG_WITH(lastlog,
3585   [  --with-lastlog=FILE|DIR specify lastlog location [common locations]],
3586         [
3587                 if test "x$withval" = "xno" ; then
3588                         AC_DEFINE(DISABLE_LASTLOG)
3589                 elif test -n "$withval"  &&  test "x${withval}" != "xyes"; then
3590                         conf_lastlog_location=$withval
3591                 fi
3592         ]
3593 )
3594
3595 dnl lastlog, [uw]tmpx? detection
3596 dnl  NOTE: set the paths in the platform section to avoid the
3597 dnl   need for command-line parameters
3598 dnl lastlog and [uw]tmp are subject to a file search if all else fails
3599
3600 dnl lastlog detection
3601 dnl  NOTE: the code itself will detect if lastlog is a directory
3602 AC_MSG_CHECKING([if your system defines LASTLOG_FILE])
3603 AC_TRY_COMPILE([
3604 #include <sys/types.h>
3605 #include <utmp.h>
3606 #ifdef HAVE_LASTLOG_H
3607 #  include <lastlog.h>
3608 #endif
3609 #ifdef HAVE_PATHS_H
3610 #  include <paths.h>
3611 #endif
3612 #ifdef HAVE_LOGIN_H
3613 # include <login.h>
3614 #endif
3615         ],
3616         [ char *lastlog = LASTLOG_FILE; ],
3617         [ AC_MSG_RESULT(yes) ],
3618         [
3619                 AC_MSG_RESULT(no)
3620                 AC_MSG_CHECKING([if your system defines _PATH_LASTLOG])
3621                 AC_TRY_COMPILE([
3622 #include <sys/types.h>
3623 #include <utmp.h>
3624 #ifdef HAVE_LASTLOG_H
3625 #  include <lastlog.h>
3626 #endif
3627 #ifdef HAVE_PATHS_H
3628 #  include <paths.h>
3629 #endif
3630                 ],
3631                 [ char *lastlog = _PATH_LASTLOG; ],
3632                 [ AC_MSG_RESULT(yes) ],
3633                 [
3634                         AC_MSG_RESULT(no)
3635                         system_lastlog_path=no
3636                 ])
3637         ]
3638 )
3639
3640 if test -z "$conf_lastlog_location"; then
3641         if test x"$system_lastlog_path" = x"no" ; then
3642                 for f in /var/log/lastlog /usr/adm/lastlog /var/adm/lastlog /etc/security/lastlog ; do
3643                                 if (test -d "$f" || test -f "$f") ; then
3644                                         conf_lastlog_location=$f
3645                                 fi
3646                 done
3647                 if test -z "$conf_lastlog_location"; then
3648                         AC_MSG_WARN([** Cannot find lastlog **])
3649                         dnl Don't define DISABLE_LASTLOG - that means we don't try wtmp/wtmpx
3650                 fi
3651         fi
3652 fi
3653
3654 if test -n "$conf_lastlog_location"; then
3655         AC_DEFINE_UNQUOTED(CONF_LASTLOG_FILE, "$conf_lastlog_location",
3656                 [Define if you want to specify the path to your lastlog file])
3657 fi
3658
3659 dnl utmp detection
3660 AC_MSG_CHECKING([if your system defines UTMP_FILE])
3661 AC_TRY_COMPILE([
3662 #include <sys/types.h>
3663 #include <utmp.h>
3664 #ifdef HAVE_PATHS_H
3665 #  include <paths.h>
3666 #endif
3667         ],
3668         [ char *utmp = UTMP_FILE; ],
3669         [ AC_MSG_RESULT(yes) ],
3670         [ AC_MSG_RESULT(no)
3671           system_utmp_path=no ]
3672 )
3673 if test -z "$conf_utmp_location"; then
3674         if test x"$system_utmp_path" = x"no" ; then
3675                 for f in /etc/utmp /usr/adm/utmp /var/run/utmp; do
3676                         if test -f $f ; then
3677                                 conf_utmp_location=$f
3678                         fi
3679                 done
3680                 if test -z "$conf_utmp_location"; then
3681                         AC_DEFINE(DISABLE_UTMP)
3682                 fi
3683         fi
3684 fi
3685 if test -n "$conf_utmp_location"; then
3686         AC_DEFINE_UNQUOTED(CONF_UTMP_FILE, "$conf_utmp_location",
3687                 [Define if you want to specify the path to your utmp file])
3688 fi
3689
3690 dnl wtmp detection
3691 AC_MSG_CHECKING([if your system defines WTMP_FILE])
3692 AC_TRY_COMPILE([
3693 #include <sys/types.h>
3694 #include <utmp.h>
3695 #ifdef HAVE_PATHS_H
3696 #  include <paths.h>
3697 #endif
3698         ],
3699         [ char *wtmp = WTMP_FILE; ],
3700         [ AC_MSG_RESULT(yes) ],
3701         [ AC_MSG_RESULT(no)
3702           system_wtmp_path=no ]
3703 )
3704 if test -z "$conf_wtmp_location"; then
3705         if test x"$system_wtmp_path" = x"no" ; then
3706                 for f in /usr/adm/wtmp /var/log/wtmp; do
3707                         if test -f $f ; then
3708                                 conf_wtmp_location=$f
3709                         fi
3710                 done
3711                 if test -z "$conf_wtmp_location"; then
3712                         AC_DEFINE(DISABLE_WTMP)
3713                 fi
3714         fi
3715 fi
3716 if test -n "$conf_wtmp_location"; then
3717         AC_DEFINE_UNQUOTED(CONF_WTMP_FILE, "$conf_wtmp_location",
3718                 [Define if you want to specify the path to your wtmp file])
3719 fi
3720
3721
3722 dnl utmpx detection - I don't know any system so perverse as to require
3723 dnl  utmpx, but not define UTMPX_FILE (ditto wtmpx.) No doubt it's out
3724 dnl  there, though.
3725 AC_MSG_CHECKING([if your system defines UTMPX_FILE])
3726 AC_TRY_COMPILE([
3727 #include <sys/types.h>
3728 #include <utmp.h>
3729 #ifdef HAVE_UTMPX_H
3730 #include <utmpx.h>
3731 #endif
3732 #ifdef HAVE_PATHS_H
3733 #  include <paths.h>
3734 #endif
3735         ],
3736         [ char *utmpx = UTMPX_FILE; ],
3737         [ AC_MSG_RESULT(yes) ],
3738         [ AC_MSG_RESULT(no)
3739           system_utmpx_path=no ]
3740 )
3741 if test -z "$conf_utmpx_location"; then
3742         if test x"$system_utmpx_path" = x"no" ; then
3743                 AC_DEFINE(DISABLE_UTMPX)
3744         fi
3745 else
3746         AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
3747                 [Define if you want to specify the path to your utmpx file])
3748 fi
3749
3750 dnl wtmpx detection
3751 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
3752 AC_TRY_COMPILE([
3753 #include <sys/types.h>
3754 #include <utmp.h>
3755 #ifdef HAVE_UTMPX_H
3756 #include <utmpx.h>
3757 #endif
3758 #ifdef HAVE_PATHS_H
3759 #  include <paths.h>
3760 #endif
3761         ],
3762         [ char *wtmpx = WTMPX_FILE; ],
3763         [ AC_MSG_RESULT(yes) ],
3764         [ AC_MSG_RESULT(no)
3765           system_wtmpx_path=no ]
3766 )
3767 if test -z "$conf_wtmpx_location"; then
3768         if test x"$system_wtmpx_path" = x"no" ; then
3769                 AC_DEFINE(DISABLE_WTMPX)
3770         fi
3771 else
3772         AC_DEFINE_UNQUOTED(CONF_WTMPX_FILE, "$conf_wtmpx_location",
3773                 [Define if you want to specify the path to your wtmpx file])
3774 fi
3775
3776
3777 if test ! -z "$blibpath" ; then
3778         LDFLAGS="$LDFLAGS $blibflags$blibpath"
3779         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
3780 fi
3781
3782 dnl remove pam and dl because they are in $LIBPAM
3783 if test "$PAM_MSG" = yes ; then
3784         LIBS=`echo $LIBS | sed 's/-lpam //'`
3785 fi
3786 if test "$ac_cv_lib_pam_pam_set_item" = yes ; then
3787         LIBS=`echo $LIBS | sed 's/-ldl //'`
3788 fi
3789
3790 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
3791 dnl Add now.
3792 CFLAGS="$CFLAGS $werror_flags"
3793
3794 AC_EXEEXT
3795 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openbsd-compat/Makefile \
3796         openbsd-compat/regress/Makefile scard/Makefile ssh_prng_cmds survey.sh])
3797 AC_OUTPUT
3798
3799 # Print summary of options
3800
3801 # Someone please show me a better way :)
3802 A=`eval echo ${prefix}` ; A=`eval echo ${A}`
3803 B=`eval echo ${bindir}` ; B=`eval echo ${B}`
3804 C=`eval echo ${sbindir}` ; C=`eval echo ${C}`
3805 D=`eval echo ${sysconfdir}` ; D=`eval echo ${D}`
3806 E=`eval echo ${libexecdir}/ssh-askpass` ; E=`eval echo ${E}`
3807 F=`eval echo ${mandir}/${mansubdir}X` ; F=`eval echo ${F}`
3808 G=`eval echo ${piddir}` ; G=`eval echo ${G}`
3809 H=`eval echo ${PRIVSEP_PATH}` ; H=`eval echo ${H}`
3810 I=`eval echo ${user_path}` ; I=`eval echo ${I}`
3811 J=`eval echo ${superuser_path}` ; J=`eval echo ${J}`
3812
3813 echo ""
3814 echo "OpenSSH has been configured with the following options:"
3815 echo "                     User binaries: $B"
3816 echo "                   System binaries: $C"
3817 echo "               Configuration files: $D"
3818 echo "                   Askpass program: $E"
3819 echo "                      Manual pages: $F"
3820 echo "                          PID file: $G"
3821 echo "  Privilege separation chroot path: $H"
3822 if test "x$external_path_file" = "x/etc/login.conf" ; then
3823 echo "   At runtime, sshd will use the path defined in $external_path_file"
3824 echo "   Make sure the path to scp is present, otherwise scp will not work"
3825 else
3826 echo "            sshd default user PATH: $I"
3827         if test ! -z "$external_path_file"; then
3828 echo "   (If PATH is set in $external_path_file it will be used instead. If"
3829 echo "   used, ensure the path to scp is present, otherwise scp will not work.)"
3830         fi
3831 fi
3832 if test ! -z "$superuser_path" ; then
3833 echo "          sshd superuser user PATH: $J"
3834 fi
3835 echo "                    Manpage format: $MANTYPE"
3836 echo "                       PAM support: $PAM_MSG"
3837 echo "                 KerberosV support: $KRB5_MSG"
3838 echo "                   SELinux support: $SELINUX_MSG"
3839 echo "                 Smartcard support: $SCARD_MSG"
3840 echo "                     S/KEY support: $SKEY_MSG"
3841 echo "              TCP Wrappers support: $TCPW_MSG"
3842 echo "              MD5 password support: $MD5_MSG"
3843 echo "                   libedit support: $LIBEDIT_MSG"
3844 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
3845 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
3846 echo "                  BSD Auth support: $BSD_AUTH_MSG"
3847 echo "              Random number source: $RAND_MSG"
3848 if test ! -z "$USE_RAND_HELPER" ; then
3849 echo "     ssh-rand-helper collects from: $RAND_HELPER_MSG"
3850 fi
3851
3852 echo ""
3853
3854 echo "              Host: ${host}"
3855 echo "          Compiler: ${CC}"
3856 echo "    Compiler flags: ${CFLAGS}"
3857 echo "Preprocessor flags: ${CPPFLAGS}"
3858 echo "      Linker flags: ${LDFLAGS}"
3859 echo "         Libraries: ${LIBWRAP} ${LIBPAM} ${LIBS}"
3860
3861 echo ""
3862
3863 if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
3864         echo "SVR4 style packages are supported with \"make package\""
3865         echo ""
3866 fi
3867
3868 if test "x$PAM_MSG" = "xyes" ; then
3869         echo "PAM is enabled. You may need to install a PAM control file "
3870         echo "for sshd, otherwise password authentication may fail. "
3871         echo "Example PAM control files can be found in the contrib/ "
3872         echo "subdirectory"
3873         echo ""
3874 fi
3875
3876 if test ! -z "$RAND_HELPER_CMDHASH" ; then
3877         echo "WARNING: you are using the builtin random number collection "
3878         echo "service. Please read WARNING.RNG and request that your OS "
3879         echo "vendor includes kernel-based random number collection in "
3880         echo "future versions of your OS."
3881         echo ""
3882 fi
3883
3884 if test ! -z "$NO_PEERCHECK" ; then
3885         echo "WARNING: the operating system that you are using does not "
3886         echo "appear to support either the getpeereid() API nor the "
3887         echo "SO_PEERCRED getsockopt() option. These facilities are used to "
3888         echo "enforce security checks to prevent unauthorised connections to "
3889         echo "ssh-agent. Their absence increases the risk that a malicious "
3890         echo "user can connect to your agent. "
3891         echo ""
3892 fi
3893
3894 if test "$AUDIT_MODULE" = "bsm" ; then
3895         echo "WARNING: BSM audit support is currently considered EXPERIMENTAL."
3896         echo "See the Solaris section in README.platform for details."
3897 fi