[buildpkg.sh.in] Last minute fix didn't make it in the .in file. :-(

[openssh.git] / configure.ac

diff --git a/configure.ac b/configure.ac
index e6f4df8d18aea4fddded75cfc0a470adc4cb2984..636528a1afdc066687c7a567b53670edafa82ad9 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -38,6 +38,13 @@ AC_PATH_PROG(TEST_MINUS_S_SH, ksh)
 AC_PATH_PROG(TEST_MINUS_S_SH, sh)
 AC_PATH_PROG(SH, sh)
 
+dnl for buildpkg.sh
+AC_PATH_PROG(PATH_GROUPADD_PROG, groupadd, groupadd,
+       [/usr/sbin${PATH_SEPARATOR}/etc])
+AC_PATH_PROG(PATH_USERADD_PROG, useradd, useradd,
+       [/usr/sbin${PATH_SEPARATOR}/etc])
+AC_CHECK_PROG(MAKE_PACKAGE_SUPPORTED, pkgmk, yes, no)
+
 # System features
 AC_SYS_LARGEFILE
 
@@ -860,6 +867,8 @@ AC_CHECK_DECL(tcsendbreak,
        [#include <termios.h>]
 )
 
+AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>])
+
 AC_CHECK_FUNCS(setresuid, [
        dnl Some platorms have setresuid that isn't implemented, test for this
        AC_MSG_CHECKING(if setresuid seems to work)
@@ -924,6 +933,20 @@ int main(void){char b[5];snprintf(b,5,"123456789");exit(b[4]!='\0');}
        )
 fi
 
+# Check for missing getpeereid (or equiv) support
+NO_PEERCHECK=""
+if test "x$ac_cv_func_getpeereid" != "xyes" ; then
+       AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
+       AC_TRY_COMPILE(
+               [#include <sys/types.h>
+                #include <sys/socket.h>],
+               [int i = SO_PEERCRED;],
+               [AC_MSG_RESULT(yes)],
+               [AC_MSG_RESULT(no)
+               NO_PEERCHECK=1]
+        )
+fi
+
 dnl see whether mkstemp() requires XXXXXX
 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
 AC_MSG_CHECKING([for (overly) strict mkstemp])
@@ -2154,6 +2177,25 @@ AC_SEARCH_LIBS(getrrsetbyname, resolv,
                # Needed by our getrrsetbyname()
                AC_SEARCH_LIBS(res_query, resolv)
                AC_SEARCH_LIBS(dn_expand, resolv)
+               AC_MSG_CHECKING(if res_query will link)
+               AC_TRY_LINK_FUNC(res_query, AC_MSG_RESULT(yes),
+                  [AC_MSG_RESULT(no)
+                   saved_LIBS="$LIBS"
+                   LIBS="$LIBS -lresolv"
+                   AC_MSG_CHECKING(for res_query in -lresolv)
+                   AC_LINK_IFELSE([
+#include <resolv.h>
+int main()
+{
+       res_query (0, 0, 0, 0, 0);
+       return 0;
+}
+                       ],
+                       [LIBS="$LIBS -lresolv"
+                        AC_MSG_RESULT(yes)],
+                       [LIBS="$saved_LIBS"
+                        AC_MSG_RESULT(no)])
+                   ])
                AC_CHECK_FUNCS(_getshort _getlong)
                AC_CHECK_MEMBER(HEADER.ad,
                        [AC_DEFINE(HAVE_HEADER_AD)],,
@@ -2207,7 +2249,10 @@ AC_ARG_WITH(kerberos5,
                                       [ char *tmp = heimdal_version; ],
                                       [ AC_MSG_RESULT(yes)
                                         AC_DEFINE(HEIMDAL)
-                                        K5LIBS="-lkrb5 -ldes -lcom_err -lasn1 -lroken"
+                                        K5LIBS="-lkrb5 -ldes"
+                                        K5LIBS="$K5LIBS -lcom_err -lasn1"
+                                        AC_CHECK_LIB(roken, net_write, 
+                                          [K5LIBS="$K5LIBS -lroken"])
                                       ],
                                       [ AC_MSG_RESULT(no)
                                         K5LIBS="-lkrb5 -lk5crypto -lcom_err"
@@ -2870,7 +2915,7 @@ if test "$ac_cv_lib_pam_pam_set_item" = yes ; then
 fi
 
 AC_EXEEXT
-AC_CONFIG_FILES([Makefile openbsd-compat/Makefile scard/Makefile ssh_prng_cmds])
+AC_CONFIG_FILES([Makefile buildpkg.sh openbsd-compat/Makefile scard/Makefile ssh_prng_cmds])
 AC_OUTPUT
 
 # Print summary of options
@@ -2935,6 +2980,10 @@ echo "         Libraries: ${LIBWRAP} ${LIBPAM} ${LIBS}"
 
 echo ""
 
+if test "x$MAKE_PACKAGE_SUPPORTED" = "xyes" ; then
+       echo "SVR4 style packages are supported with \"make package\"\n"
+fi
+
 if test "x$PAM_MSG" = "xyes" ; then
        echo "PAM is enabled. You may need to install a PAM control file "
        echo "for sshd, otherwise password authentication may fail. "
@@ -2951,3 +3000,13 @@ if test ! -z "$RAND_HELPER_CMDHASH" ; then
        echo ""
 fi
 
+if test ! -z "$NO_PEERCHECK" ; then
+       echo "WARNING: the operating system that you are using does not "
+       echo "appear to support either the getpeereid() API nor the "
+       echo "SO_PEERCRED getsockopt() option. These facilities are used to "
+       echo "enforce security checks to prevent unauthorised connections to "
+       echo "ssh-agent. Their absence increases the risk that a malicious "
+       echo "user can connect to your agent. "
+       echo ""
+fi
+