* New upstream release (closes: #395507, #397961, #420035). Important

  changes not previously backported to 4.3p2:
  - 4.4/4.4p1 (http://www.openssh.org/txt/release-4.4):
    + On portable OpenSSH, fix a GSSAPI authentication abort that could be
      used to determine the validity of usernames on some platforms.
    + Implemented conditional configuration in sshd_config(5) using the
      "Match" directive. This allows some configuration options to be
      selectively overridden if specific criteria (based on user, group,
      hostname and/or address) are met. So far a useful subset of
      post-authentication options are supported and more are expected to
      be added in future releases.
    + Add support for Diffie-Hellman group exchange key agreement with a
      final hash of SHA256.
    + Added a "ForceCommand" directive to sshd_config(5). Similar to the
      command="..." option accepted in ~/.ssh/authorized_keys, this forces
      the execution of the specified command regardless of what the user
      requested. This is very useful in conjunction with the new "Match"
      option.
    + Add a "PermitOpen" directive to sshd_config(5). This mirrors the
      permitopen="..." authorized_keys option, allowing fine-grained
      control over the port-forwardings that a user is allowed to
      establish.
    + Add optional logging of transactions to sftp-server(8).
    + ssh(1) will now record port numbers for hosts stored in
      ~/.ssh/known_hosts when a non-standard port has been requested
      (closes: #50612).
    + Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a
      non-zero exit code) when requested port forwardings could not be
      established.
    + Extend sshd_config(5) "SubSystem" declarations to allow the
      specification of command-line arguments.
    + Replacement of all integer overflow susceptible invocations of
      malloc(3) and realloc(3) with overflow-checking equivalents.
    + Many manpage fixes and improvements.
    + Add optional support for OpenSSL hardware accelerators (engines),
      enabled using the --with-ssl-engine configure option.
    + Tokens in configuration files may be double-quoted in order to
      contain spaces (closes: #319639).
    + Move a debug() call out of a SIGCHLD handler, fixing a hang when the
      session exits very quickly (closes: #307890).
    + Fix some incorrect buffer allocation calculations (closes: #410599).
    + ssh-add doesn't ask for a passphrase if key file permissions are too
      liberal (closes: #103677).
    + Likewise, ssh doesn't ask either (closes: #99675).
  - 4.6/4.6p1 (http://www.openssh.org/txt/release-4.6):
    + sshd now allows the enabling and disabling of authentication methods
      on a per user, group, host and network basis via the Match directive
      in sshd_config.
    + Fixed an inconsistent check for a terminal when displaying scp
      progress meter (closes: #257524).
    + Fix "hang on exit" when background processes are running at the time
      of exit on a ttyful/login session (closes: #88337).
* Update to current GSSAPI patch from
  http://www.sxw.org.uk/computing/patches/openssh-4.6p1-gsskex-20070312.patch;
  install ChangeLog.gssapi.

1 files changed, 440 insertions, 250 deletions

diff --git a/configure.ac b/configure.ac
index 86f0f1c41..05ccc2f7e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.322.2.6 2006/02/08 11:11:06 dtucker Exp $
+# $Id: configure.ac,v 1.372 2007/03/05 00:51:27 djm Exp $
 #
 # Copyright (c) 1999-2004 Damien Miller
 #
@@ -15,7 +15,7 @@
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
-AC_REVISION($Revision: 1.322.2.6 $)
+AC_REVISION($Revision: 1.372 $)
 AC_CONFIG_SRCDIR([ssh.c])
 
 AC_CONFIG_HEADER(config.h)
@@ -127,15 +127,175 @@ AC_ARG_WITH(rpath,
         ]
 )
 
+# Allow user to specify flags
+AC_ARG_WITH(cflags,
+        [  --with-cflags           Specify additional flags to pass to compiler],
+        [
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
+                        CFLAGS="$CFLAGS $withval"
+                fi
+        ]
+)
+AC_ARG_WITH(cppflags,
+        [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
+        [
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
+                        CPPFLAGS="$CPPFLAGS $withval"
+                fi
+        ]
+)
+AC_ARG_WITH(ldflags,
+        [  --with-ldflags          Specify additional flags to pass to linker],
+        [
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
+                        LDFLAGS="$LDFLAGS $withval"
+                fi
+        ]
+)
+AC_ARG_WITH(libs,
+        [  --with-libs             Specify additional libraries to link with],
+        [
+                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
+                    test "x${withval}" != "xyes"; then
+                        LIBS="$LIBS $withval"
+                fi
+        ]
+)
+AC_ARG_WITH(Werror,
+        [  --with-Werror           Build main code with -Werror],
+        [
+                if test -n "$withval"  &&  test "x$withval" != "xno"; then
+                        werror_flags="-Werror"
+                        if test "x${withval}" != "xyes"; then
+                                werror_flags="$withval"
+                        fi
+                fi
+        ]
+)
+
+AC_CHECK_HEADERS( \
+        bstring.h \
+        crypt.h \
+        crypto/sha2.h \
+        dirent.h \
+        endian.h \
+        features.h \
+        fcntl.h \
+        floatingpoint.h \
+        getopt.h \
+        glob.h \
+        ia.h \
+        iaf.h \
+        limits.h \
+        login.h \
+        maillock.h \
+        ndir.h \
+        net/if_tun.h \
+        netdb.h \
+        netgroup.h \
+        pam/pam_appl.h \
+        paths.h \
+        pty.h \
+        readpassphrase.h \
+        rpc/types.h \
+        security/pam_appl.h \
+        sha2.h \
+        shadow.h \
+        stddef.h \
+        stdint.h \
+        string.h \
+        strings.h \
+        sys/audit.h \
+        sys/bitypes.h \
+        sys/bsdtty.h \
+        sys/cdefs.h \
+        sys/dir.h \
+        sys/mman.h \
+        sys/ndir.h \
+        sys/prctl.h \
+        sys/pstat.h \
+        sys/select.h \
+        sys/stat.h \
+        sys/stream.h \
+        sys/stropts.h \
+        sys/strtio.h \
+        sys/sysmacros.h \
+        sys/time.h \
+        sys/timers.h \
+        sys/un.h \
+        time.h \
+        tmpdir.h \
+        ttyent.h \
+        unistd.h \
+        usersec.h \
+        util.h \
+        utime.h \
+        utmp.h \
+        utmpx.h \
+        vis.h \
+)
+
+# lastlog.h requires sys/time.h to be included first on Solaris
+AC_CHECK_HEADERS(lastlog.h, [], [], [
+#ifdef HAVE_SYS_TIME_H
+# include <sys/time.h>
+#endif
+])
+
+# sys/ptms.h requires sys/stream.h to be included first on Solaris
+AC_CHECK_HEADERS(sys/ptms.h, [], [], [
+#ifdef HAVE_SYS_STREAM_H
+# include <sys/stream.h>
+#endif
+])
+
+# login_cap.h requires sys/types.h on NetBSD
+AC_CHECK_HEADERS(login_cap.h, [], [], [
+#include <sys/types.h>
+])
+
+# Messages for features tested for in target-specific section
+SIA_MSG="no"
+SPC_MSG="no"
+
 # Check for some target-specific stuff
 case "$host" in
 *-*-aix*)
+        # Some versions of VAC won't allow macro redefinitions at
+        # -qlanglevel=ansi, and autoconf 2.60 sometimes insists on using that
+        # particularly with older versions of vac or xlc.
+        # It also throws errors about null macro argments, but these are
+        # not fatal.
+        AC_MSG_CHECKING(if compiler allows macro redefinitions)
+        AC_COMPILE_IFELSE(
+            [AC_LANG_SOURCE([[
+#define testmacro foo
+#define testmacro bar
+int main(void) { exit(0); }
+            ]])],
+            [ AC_MSG_RESULT(yes) ],
+            [ AC_MSG_RESULT(no)
+              CC="`echo $CC | sed 's/-qlanglvl\=ansi//g'`"
+              LD="`echo $LD | sed 's/-qlanglvl\=ansi//g'`"
+              CFLAGS="`echo $CFLAGS | sed 's/-qlanglvl\=ansi//g'`"
+              CPPFLAGS="`echo $CPPFLAGS | sed 's/-qlanglvl\=ansi//g'`"
+            ]
+        )
+
         AC_MSG_CHECKING([how to specify blibpath for linker ($LD)])
         if (test -z "$blibpath"); then
                 blibpath="/usr/lib:/lib"
         fi
         saved_LDFLAGS="$LDFLAGS"
-        for tryflags in -blibpath: -Wl,-blibpath: -Wl,-rpath, ;do
+        if test "$GCC" = "yes"; then
+                flags="-Wl,-blibpath: -Wl,-rpath, -blibpath:"
+        else
+                flags="-blibpath: -Wl,-blibpath: -Wl,-rpath,"
+        fi
+        for tryflags in $flags ;do
                 if (test -z "$blibflags"); then
                         LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
                         AC_TRY_LINK([], [], [blibflags=$tryflags])
@@ -175,6 +335,12 @@ case "$host" in
                 [#include <usersec.h>]
         )
         AC_CHECK_FUNCS(setauthdb)
+        AC_CHECK_DECL(F_CLOSEM,
+            AC_DEFINE(HAVE_FCNTL_CLOSEM, 1, [Use F_CLOSEM fcntl for closefrom]),
+            [],
+            [ #include <limits.h>
+              #include <fcntl.h> ]
+        )
         check_for_aix_broken_getaddrinfo=1
         AC_DEFINE(BROKEN_REALPATH, 1, [Define if you have a broken realpath.])
         AC_DEFINE(SETEUID_BREAKS_SETUID, 1,
@@ -190,10 +356,11 @@ case "$host" in
                 supported by bsd-setproctitle.c])
         AC_DEFINE(SSHPAM_CHAUTHTOK_NEEDS_RUID, 1,
             [AIX 5.2 and 5.3 (and presumably newer) require this])
+        AC_DEFINE(PTY_ZEROREAD, 1, [read(1) can return 0 for a non-closed fd])
         ;;
 *-*-cygwin*)
         check_for_libcrypt_later=1
-        LIBS="$LIBS /usr/lib/textmode.o"
+        LIBS="$LIBS /usr/lib/textreadmode.o"
         AC_DEFINE(HAVE_CYGWIN, 1, [Define if you are on Cygwin])
         AC_DEFINE(USE_PIPES, 1, [Use PIPES instead of a socketpair()])
         AC_DEFINE(DISABLE_SHADOW, 1,
@@ -231,30 +398,38 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
         AC_DEFINE(BROKEN_SETREGID)
         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
                 [Define if your resolver libs need this for getrrsetbyname])
-        AC_MSG_CHECKING(if we have the Security Authorization Session API)
-        AC_TRY_COMPILE([#include <Security/AuthSession.h>],
-                [SessionCreate(0, 0);],
-                [ac_cv_use_security_session_api="yes"
-                 AC_DEFINE(USE_SECURITY_SESSION_API, 1, 
+        AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
+        AC_DEFINE(SSH_TUN_COMPAT_AF, 1,
+            [Use tunnel device compatibility to OpenBSD])
+        AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
+            [Prepend the address family to IP tunnel traffic])
+        AC_MSG_CHECKING(if we have the Security Authorization Session API)
+        AC_TRY_COMPILE([#include <Security/AuthSession.h>],
+                [SessionCreate(0, 0);],
+                [ac_cv_use_security_session_api="yes"
+                 AC_DEFINE(USE_SECURITY_SESSION_API, 1, 
                         [platform has the Security Authorization Session API])
-                 LIBS="$LIBS -framework Security"
-                 AC_MSG_RESULT(yes)],
-                [ac_cv_use_security_session_api="no"
-                 AC_MSG_RESULT(no)])
-        AC_MSG_CHECKING(if we have an in-memory credentials cache)
-        AC_TRY_COMPILE(
-                [#include <Kerberos/Kerberos.h>],
-                [cc_context_t c;
-                 (void) cc_initialize (&c, 0, NULL, NULL);],
-                [AC_DEFINE(USE_CCAPI, 1, 
+                 LIBS="$LIBS -framework Security"
+                 AC_MSG_RESULT(yes)],
+                [ac_cv_use_security_session_api="no"
+                 AC_MSG_RESULT(no)])
+        AC_MSG_CHECKING(if we have an in-memory credentials cache)
+        AC_TRY_COMPILE(
+                [#include <Kerberos/Kerberos.h>],
+                [cc_context_t c;
+                 (void) cc_initialize (&c, 0, NULL, NULL);],
+                [AC_DEFINE(USE_CCAPI, 1, 
                         [platform uses an in-memory credentials cache])
-                 LIBS="$LIBS -framework Security"
-                 AC_MSG_RESULT(yes)
-                 if test "x$ac_cv_use_security_session_api" = "xno"; then
-                        AC_MSG_ERROR(*** Need a security framework to use the credentials cache API ***)
-                fi],
-                [AC_MSG_RESULT(no)]
-        )
+                 LIBS="$LIBS -framework Security"
+                 AC_MSG_RESULT(yes)
+                 if test "x$ac_cv_use_security_session_api" = "xno"; then
+                        AC_MSG_ERROR(*** Need a security framework to use the credentials cache API ***)
+                fi],
+                [AC_MSG_RESULT(no)]
+        )
+        ;;
+*-*-dragonfly*)
+        SSHDLIBS="$SSHDLIBS -lcrypt"
         ;;
 *-*-hpux*)
         # first we define all of the options common to all HP-UX releases
@@ -417,6 +592,8 @@ mips-sony-bsd|mips-sony-newsos4)
         AC_DEFINE(HAVE_ATTRIBUTE__SENTINEL__, 1, [OpenBSD's gcc has sentinel])
         AC_DEFINE(HAVE_ATTRIBUTE__BOUNDED__, 1, [OpenBSD's gcc has bounded])
         AC_DEFINE(SSH_TUN_OPENBSD, 1, [Open tunnel devices the OpenBSD way])
+        AC_DEFINE(SYSLOG_R_SAFE_IN_SIGHAND, 1,
+            [syslog_r function is safe to use in in a signal handler])
         ;;
 *-*-solaris*)
         if test "x$withval" != "xno" ; then
@@ -436,6 +613,8 @@ mips-sony-bsd|mips-sony-newsos4)
         AC_DEFINE(SSHD_ACQUIRES_CTTY, 1,
                 [Define if sshd somehow reacquires a controlling TTY
                 after setsid()])
+        AC_DEFINE(PASSWD_NEEDS_USERNAME, 1, [must supply username to passwd
+                in case the name is longer than 8 chars])
         external_path_file=/etc/default/login
         # hardwire lastlog location (can't detect it on some versions)
         conf_lastlog_location="/var/adm/lastlog"
@@ -449,6 +628,17 @@ mips-sony-bsd|mips-sony-newsos4)
         else
                 AC_MSG_RESULT(no)
         fi
+        AC_ARG_WITH(solaris-contracts,
+                [  --with-solaris-contracts Enable Solaris process contracts (experimental)],
+                [
+                AC_CHECK_LIB(contract, ct_tmpl_activate,
+                        [ AC_DEFINE(USE_SOLARIS_PROCESS_CONTRACTS, 1,
+                                [Define if you have Solaris process contracts])
+                          SSHDLIBS="$SSHDLIBS -lcontract"
+                          AC_SUBST(SSHDLIBS)
+                          SPC_MSG="yes" ], )
+                ],
+        )
         ;;
 *-*-sunos4*)
         CPPFLAGS="$CPPFLAGS -DSUNOS4"
@@ -486,7 +676,6 @@ mips-sony-bsd|mips-sony-newsos4)
         ;;
 # UnixWare 1.x, UnixWare 2.x, and others based on code from Univel.
 *-*-sysv4.2*)
-        CFLAGS="$CFLAGS -Dva_list=_VA_LIST"
         AC_DEFINE(USE_PIPES)
         AC_DEFINE(SETEUID_BREAKS_SETUID)
         AC_DEFINE(BROKEN_SETREUID)
@@ -508,6 +697,7 @@ mips-sony-bsd|mips-sony-newsos4)
                 TEST_SHELL=/u95/bin/sh
                 AC_DEFINE(BROKEN_LIBIAF, 1,
                         [ia_uinfo routines not supported by OS yet])
+                AC_DEFINE(BROKEN_UPDWTMPX)
                 ;;
         *)      AC_DEFINE(LOCKED_PASSWD_STRING, "*LK*")
                 ;;
@@ -597,6 +787,7 @@ mips-sony-bsd|mips-sony-newsos4)
                                 system's login() call])
                         AC_DEFINE(DISABLE_FD_PASSING)
                         LIBS="$LIBS -lsecurity -ldb -lm -laud"
+                        SIA_MSG="yes"
                 else
                         AC_MSG_RESULT(no)
                         AC_DEFINE(LOCKED_PASSWD_SUBSTR, "Nologin",
@@ -616,6 +807,8 @@ mips-sony-bsd|mips-sony-newsos4)
         AC_DEFINE(MISSING_HOWMANY, 1, [Define on *nto-qnx systems])
         AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
         AC_DEFINE(DISABLE_LASTLOG)
+        AC_DEFINE(SSHD_ACQUIRES_CTTY)
+        enable_etc_default_login=no     # has incompatible /etc/default/login
         ;;
 
 *-*-ultrix*)
@@ -632,55 +825,6 @@ mips-sony-bsd|mips-sony-newsos4)
         ;;
 esac
 
-# Allow user to specify flags
-AC_ARG_WITH(cflags,
-        [  --with-cflags           Specify additional flags to pass to compiler],
-        [
-                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
-                    test "x${withval}" != "xyes"; then
-                        CFLAGS="$CFLAGS $withval"
-                fi
-        ]
-)
-AC_ARG_WITH(cppflags,
-        [  --with-cppflags         Specify additional flags to pass to preprocessor] ,
-        [
-                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
-                    test "x${withval}" != "xyes"; then
-                        CPPFLAGS="$CPPFLAGS $withval"
-                fi
-        ]
-)
-AC_ARG_WITH(ldflags,
-        [  --with-ldflags          Specify additional flags to pass to linker],
-        [
-                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
-                    test "x${withval}" != "xyes"; then
-                        LDFLAGS="$LDFLAGS $withval"
-                fi
-        ]
-)
-AC_ARG_WITH(libs,
-        [  --with-libs             Specify additional libraries to link with],
-        [
-                if test -n "$withval"  &&  test "x$withval" != "xno"  &&  \
-                    test "x${withval}" != "xyes"; then
-                        LIBS="$LIBS $withval"
-                fi
-        ]
-)
-AC_ARG_WITH(Werror,
-        [  --with-Werror           Build main code with -Werror],
-        [
-                if test -n "$withval"  &&  test "x$withval" != "xno"; then
-                        werror_flags="-Werror"
-                        if test "x${withval}" != "xyes"; then
-                                werror_flags="$withval"
-                        fi
-                fi
-        ]
-)
-
 AC_MSG_CHECKING(compiler and flags for sanity)
 AC_RUN_IFELSE(
         [AC_LANG_SOURCE([
@@ -696,79 +840,6 @@ int main(){exit(0);}
 )
 
 dnl Checks for header files.
-AC_CHECK_HEADERS( \
-        bstring.h \
-        crypt.h \
-        dirent.h \
-        endian.h \
-        features.h \
-        floatingpoint.h \
-        getopt.h \
-        glob.h \
-        ia.h \
-        iaf.h \
-        limits.h \
-        login.h \
-        login_cap.h \
-        maillock.h \
-        ndir.h \
-        netdb.h \
-        netgroup.h \
-        pam/pam_appl.h \
-        paths.h \
-        pty.h \
-        readpassphrase.h \
-        rpc/types.h \
-        security/pam_appl.h \
-        shadow.h \
-        stddef.h \
-        stdint.h \
-        string.h \
-        strings.h \
-        sys/audit.h \
-        sys/bitypes.h \
-        sys/bsdtty.h \
-        sys/cdefs.h \
-        sys/dir.h \
-        sys/mman.h \
-        sys/ndir.h \
-        sys/prctl.h \
-        sys/pstat.h \
-        sys/select.h \
-        sys/stat.h \
-        sys/stream.h \
-        sys/stropts.h \
-        sys/strtio.h \
-        sys/sysmacros.h \
-        sys/time.h \
-        sys/timers.h \
-        sys/un.h \
-        time.h \
-        tmpdir.h \
-        ttyent.h \
-        unistd.h \
-        usersec.h \
-        util.h \
-        utime.h \
-        utmp.h \
-        utmpx.h \
-        vis.h \
-)
-
-# lastlog.h requires sys/time.h to be included first on Solaris
-AC_CHECK_HEADERS(lastlog.h, [], [], [
-#ifdef HAVE_SYS_TIME_H
-# include <sys/time.h>
-#endif
-])
-
-# sys/ptms.h requires sys/stream.h to be included first on Solaris
-AC_CHECK_HEADERS(sys/ptms.h, [], [], [
-#ifdef HAVE_SYS_STREAM_H
-# include <sys/stream.h>
-#endif
-])
-
 # Checks for libraries.
 AC_CHECK_FUNC(yp_match, , AC_CHECK_LIB(nsl, yp_match))
 AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt))
@@ -953,11 +1024,9 @@ AC_EGREP_CPP(FOUNDIT,
 
 # Check for g.gl_matchc glob() extension
 AC_MSG_CHECKING(for gl_matchc field in glob_t)
-AC_EGREP_CPP(FOUNDIT,
-        [
-                #include <glob.h>
-                int main(void){glob_t g; g.gl_matchc = 1;}
-        ],
+AC_TRY_COMPILE(
+        [ #include <glob.h> ],
+        [glob_t g; g.gl_matchc = 1;],
         [
                 AC_DEFINE(GLOB_HAS_GL_MATCHC, 1,
                         [Define if your system glob() function has
@@ -969,6 +1038,8 @@ AC_EGREP_CPP(FOUNDIT,
         ]
 )
 
+AC_CHECK_DECLS(GLOB_NOMATCH, , , [#include <glob.h>])
+
 AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
 AC_RUN_IFELSE(
         [AC_LANG_SOURCE([[
@@ -1150,7 +1221,13 @@ AC_ARG_WITH(audit,
                 AUDIT_MODULE=bsm
                 dnl    Checks for headers, libs and functions
                 AC_CHECK_HEADERS(bsm/audit.h, [],
-                    [AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)])
+                    [AC_MSG_ERROR(BSM enabled and bsm/audit.h not found)],
+                    [
+#ifdef HAVE_TIME_H
+# include <time.h>
+#endif
+                    ]
+)
                 AC_CHECK_LIB(bsm, getaudit, [],
                     [AC_MSG_ERROR(BSM enabled and required library not found)])
                 AC_CHECK_FUNCS(getaudit, [],
@@ -1296,6 +1373,29 @@ AC_CHECK_DECL(tcsendbreak,
 
 AC_CHECK_DECLS(h_errno, , ,[#include <netdb.h>])
 
+AC_CHECK_DECLS(SHUT_RD, , ,
+        [
+#include <sys/types.h>
+#include <sys/socket.h>
+        ])
+
+AC_CHECK_DECLS(O_NONBLOCK, , ,
+        [
+#include <sys/types.h>
+#ifdef HAVE_SYS_STAT_H
+# include <sys/stat.h>
+#endif
+#ifdef HAVE_FCNTL_H
+# include <fcntl.h>
+#endif
+        ])
+
+AC_CHECK_DECLS(writev, , , [
+#include <sys/types.h>
+#include <sys/uio.h>
+#include <unistd.h>
+        ])
+
 AC_CHECK_FUNCS(setresuid, [
         dnl Some platorms have setresuid that isn't implemented, test for this
         AC_MSG_CHECKING(if setresuid seems to work)
@@ -1666,61 +1766,6 @@ fi
 
 AC_FUNC_GETPGRP
 
-# Check for PAM libs
-PAM_MSG="no"
-AC_ARG_WITH(pam,
-        [  --with-pam              Enable PAM support ],
-        [
-                if test "x$withval" != "xno" ; then
-                        if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
-                           test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
-                                AC_MSG_ERROR([PAM headers not found])
-                        fi
-
-                        AC_CHECK_LIB(dl, dlopen, , )
-                        AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
-                        AC_CHECK_FUNCS(pam_getenvlist)
-                        AC_CHECK_FUNCS(pam_putenv)
-
-                        PAM_MSG="yes"
-
-                        AC_DEFINE(USE_PAM, 1,
-                                [Define if you want to enable PAM support])
-                        if test $ac_cv_lib_dl_dlopen = yes; then
-                                LIBPAM="-lpam -ldl"
-                        else
-                                LIBPAM="-lpam"
-                        fi
-                        AC_SUBST(LIBPAM)
-                fi
-        ]
-)
-
-# Check for older PAM
-if test "x$PAM_MSG" = "xyes" ; then
-        # Check PAM strerror arguments (old PAM)
-        AC_MSG_CHECKING([whether pam_strerror takes only one argument])
-        AC_TRY_COMPILE(
-                [
-#include <stdlib.h>
-#if defined(HAVE_SECURITY_PAM_APPL_H)
-#include <security/pam_appl.h>
-#elif defined (HAVE_PAM_PAM_APPL_H)
-#include <pam/pam_appl.h>
-#endif
-                ],
-                [(void)pam_strerror((pam_handle_t *)NULL, -1);],
-                [AC_MSG_RESULT(no)],
-                [
-                        AC_DEFINE(HAVE_OLD_PAM, 1,
-                                [Define if you have an old version of PAM
-                                which takes only one argument to pam_strerror])
-                        AC_MSG_RESULT(yes)
-                        PAM_MSG="yes (old library)"
-                ]
-        )
-fi
-
 # Search for OpenSSL
 saved_CPPFLAGS="$CPPFLAGS"
 saved_LDFLAGS="$LDFLAGS"
@@ -1844,6 +1889,14 @@ int main(void) {
         ]
 )
 
+AC_ARG_WITH(openssl-header-check,
+        [  --without-openssl-header-check Disable OpenSSL version consistency check],
+        [  if test "x$withval" = "xno" ; then
+                openssl_check_nonfatal=1
+           fi
+        ]
+)
+
 # Sanity check OpenSSL headers
 AC_MSG_CHECKING([whether OpenSSL's headers match the library])
 AC_RUN_IFELSE(
@@ -1857,18 +1910,75 @@ int main(void) { exit(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
         ],
         [
                 AC_MSG_RESULT(no)
-                AC_MSG_ERROR([Your OpenSSL headers do not match your library.
-Check config.log for details.
+                if test "x$openssl_check_nonfatal" = "x"; then
+                        AC_MSG_ERROR([Your OpenSSL headers do not match your
+library. Check config.log for details.
+If you are sure your installation is consistent, you can disable the check
+by running "./configure --without-openssl-header-check".
+Also see contrib/findssl.sh for help identifying header/library mismatches.
+])
+                else
+                        AC_MSG_WARN([Your OpenSSL headers do not match your
+library. Check config.log for details.
 Also see contrib/findssl.sh for help identifying header/library mismatches.])
+                fi
         ],
         [
                 AC_MSG_WARN([cross compiling: not checking])
         ]
 )
 
+AC_MSG_CHECKING([if programs using OpenSSL functions will link])
+AC_LINK_IFELSE(
+        [AC_LANG_SOURCE([[
+#include <openssl/evp.h>
+int main(void) { SSLeay_add_all_algorithms(); }
+        ]])],
+        [
+                AC_MSG_RESULT(yes)
+        ],
+        [
+                AC_MSG_RESULT(no)
+                saved_LIBS="$LIBS"
+                LIBS="$LIBS -ldl"
+                AC_MSG_CHECKING([if programs using OpenSSL need -ldl])
+                AC_LINK_IFELSE(
+                        [AC_LANG_SOURCE([[
+#include <openssl/evp.h>
+int main(void) { SSLeay_add_all_algorithms(); }
+                        ]])],
+                        [
+                                AC_MSG_RESULT(yes)
+                        ],
+                        [
+                                AC_MSG_RESULT(no)
+                                LIBS="$saved_LIBS"
+                        ]
+                )
+        ]
+)
+
+AC_ARG_WITH(ssl-engine,
+        [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
+        [ if test "x$withval" != "xno" ; then
+                AC_MSG_CHECKING(for OpenSSL ENGINE support)
+                AC_TRY_COMPILE(
+                        [ #include <openssl/engine.h>],
+                        [
+ENGINE_load_builtin_engines();ENGINE_register_all_complete();
+                        ],
+                        [ AC_MSG_RESULT(yes)
+                          AC_DEFINE(USE_OPENSSL_ENGINE, 1,
+                             [Enable OpenSSL engine support])
+                        ],
+                        [ AC_MSG_ERROR(OpenSSL ENGINE support not found)]
+                )
+          fi ]
+)
+
 # Check for OpenSSL without EVP_aes_{192,256}_cbc
 AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
-AC_COMPILE_IFELSE(
+AC_LINK_IFELSE(
         [AC_LANG_SOURCE([[
 #include <string.h>
 #include <openssl/evp.h>
@@ -1896,6 +2006,9 @@ if test "x$check_for_libcrypt_later" = "x1"; then
         AC_CHECK_LIB(crypt, crypt, LIBS="$LIBS -lcrypt")
 fi
 
+# Search for SHA256 support in libc and/or OpenSSL
+AC_CHECK_FUNCS(SHA256_Update EVP_sha256)
+
 AC_CHECK_LIB(iaf, ia_openinfo)
 
 ### Configure cryptographic random number support
@@ -1926,6 +2039,69 @@ int main(void) { exit(RAND_status() == 1 ? 0 : 1); }
         ]
 )
 
+# Check for PAM libs
+PAM_MSG="no"
+AC_ARG_WITH(pam,
+        [  --with-pam              Enable PAM support ],
+        [
+                if test "x$withval" != "xno" ; then
+                        if test "x$ac_cv_header_security_pam_appl_h" != "xyes" && \
+                           test "x$ac_cv_header_pam_pam_appl_h" != "xyes" ; then
+                                AC_MSG_ERROR([PAM headers not found])
+                        fi
+
+                        saved_LIBS="$LIBS"
+                        AC_CHECK_LIB(dl, dlopen, , )
+                        AC_CHECK_LIB(pam, pam_set_item, , AC_MSG_ERROR([*** libpam missing]))
+                        AC_CHECK_FUNCS(pam_getenvlist)
+                        AC_CHECK_FUNCS(pam_putenv)
+                        LIBS="$saved_LIBS"
+
+                        PAM_MSG="yes"
+
+                        LIBPAM="-lpam"
+                        AC_DEFINE(USE_PAM, 1,
+                                [Define if you want to enable PAM support])
+
+                        if test $ac_cv_lib_dl_dlopen = yes; then
+                                case "$LIBS" in
+                                *-ldl*)
+                                        # libdl already in LIBS
+                                        ;;
+                                *)
+                                        LIBPAM="$LIBPAM -ldl"
+                                        ;;
+                                esac
+                        fi
+                        AC_SUBST(LIBPAM)
+                fi
+        ]
+)
+
+# Check for older PAM
+if test "x$PAM_MSG" = "xyes" ; then
+        # Check PAM strerror arguments (old PAM)
+        AC_MSG_CHECKING([whether pam_strerror takes only one argument])
+        AC_TRY_COMPILE(
+                [
+#include <stdlib.h>
+#if defined(HAVE_SECURITY_PAM_APPL_H)
+#include <security/pam_appl.h>
+#elif defined (HAVE_PAM_PAM_APPL_H)
+#include <pam/pam_appl.h>
+#endif
+                ],
+                [(void)pam_strerror((pam_handle_t *)NULL, -1);],
+                [AC_MSG_RESULT(no)],
+                [
+                        AC_DEFINE(HAVE_OLD_PAM, 1,
+                                [Define if you have an old version of PAM
+                                which takes only one argument to pam_strerror])
+                        AC_MSG_RESULT(yes)
+                        PAM_MSG="yes (old library)"
+                ]
+        )
+fi
 
 # Do we want to force the use of the rand helper?
 AC_ARG_WITH(rand-helper,
@@ -2145,6 +2321,34 @@ if test -z "$have_llong_max"; then
 #define __USE_ISOC99
 #include <limits.h>
 #define DATA "conftest.llminmax"
+#define my_abs(a) ((a) < 0 ? ((a) * -1) : (a))
+
+/*
+ * printf in libc on some platforms (eg old Tru64) does not understand %lld so
+ * we do this the hard way.
+ */
+static int
+fprint_ll(FILE *f, long long n)
+{
+        unsigned int i;
+        int l[sizeof(long long) * 8];
+
+        if (n < 0)
+                if (fprintf(f, "-") < 0)
+                        return -1;
+        for (i = 0; n != 0; i++) {
+                l[i] = my_abs(n % 10);
+                n /= 10;
+        }
+        do {
+                if (fprintf(f, "%d", l[--i]) < 0)
+                        return -1;
+        } while (i != 0);
+        if (fprintf(f, " ") < 0)
+                return -1;
+        return 0;
+}
+
 int main(void) {
         FILE *f;
         long long i, llmin, llmax = 0;
@@ -2166,14 +2370,18 @@ int main(void) {
 
         /* Sanity check */
         if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
-            || llmax - 1 > llmax) {
+            || llmax - 1 > llmax || llmin == llmax || llmin == 0
+            || llmax == 0 || llmax < LONG_MAX || llmin > LONG_MIN) {
                 fprintf(f, "unknown unknown\n");
                 exit(2);
         }
 
-        if (fprintf(f ,"%lld %lld", llmin, llmax) < 0)
+        if (fprint_ll(f, llmin) < 0)
                 exit(3);
-
+        if (fprint_ll(f, llmax) < 0)
+                exit(4);
+        if (fclose(f) < 0)
+                exit(5);
         exit(0);
 }
                 ]])],
@@ -2181,17 +2389,6 @@ int main(void) {
                         llong_min=`$AWK '{print $1}' conftest.llminmax`
                         llong_max=`$AWK '{print $2}' conftest.llminmax`
 
-                        # snprintf on some Tru64s doesn't understand "%lld"
-                        case "$host" in
-                        alpha-dec-osf*)
-                                if test "x$ac_cv_sizeof_long_long_int" = "x8" &&
-                                  test "x$llong_max" = "xld"; then
-                                        llong_min="-9223372036854775808"
-                                        llong_max="9223372036854775807"
-                                fi
-                                ;;
-                        esac
-
                         AC_MSG_RESULT($llong_max)
                         AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
                             [max value of long long calculated by configure])
@@ -2937,7 +3134,7 @@ AC_ARG_WITH(opensc,
                         LIBOPENSC_CFLAGS=`$OPENSC_CONFIG --cflags`
                         LIBOPENSC_LIBS=`$OPENSC_CONFIG --libs`
                         CPPFLAGS="$CPPFLAGS $LIBOPENSC_CFLAGS"
-                        LDFLAGS="$LDFLAGS $LIBOPENSC_LIBS"
+                        LIBS="$LIBS $LIBOPENSC_LIBS"
                         AC_DEFINE(SMARTCARD)
                         AC_DEFINE(USE_OPENSC, 1,
                                 [Define if you want smartcard support
@@ -2989,22 +3186,20 @@ int main()
 SELINUX_MSG="no"
 LIBSELINUX=""
 AC_ARG_WITH(selinux,
-        [  --with-selinux[[=LIBSELINUX-PATH]]   Enable SELinux support],
+        [  --with-selinux   Enable SELinux support],
         [ if test "x$withval" != "xno" ; then
-                if test "x$withval" != "xyes"; then
-                        CPPFLAGS="$CPPFLAGS -I${withval}/include"
-                        if test -n "${need_dash_r}"; then
-                                LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
-                        else
-                                LDFLAGS="-L${withval}/lib ${LDFLAGS}"
-                        fi
-               fi 
                 AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
                 SELINUX_MSG="yes"
-                AC_CHECK_HEADERS(selinux/selinux.h)
-                LIBSELINUX="-lselinux"
-        fi
-        ])
+                AC_CHECK_HEADER([selinux/selinux.h], ,
+                    AC_MSG_ERROR(SELinux support requires selinux.h header))
+                AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
+                    AC_MSG_ERROR(SELinux support requires libselinux library))
+                save_LIBS="$LIBS"
+                LIBS="$LIBS $LIBSELINUX"
+                AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
+                LIBS="$save_LIBS"
+        fi ]
+)
 AC_SUBST(LIBSELINUX)
 
 # Check whether user wants Kerberos 5 support
@@ -3769,20 +3964,13 @@ if test ! -z "$blibpath" ; then
         AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
 fi
 
-dnl remove pam and dl because they are in $LIBPAM
-if test "$PAM_MSG" = yes ; then
-        LIBS=`echo $LIBS | sed 's/-lpam //'`
-fi
-if test "$ac_cv_lib_pam_pam_set_item" = yes ; then
-        LIBS=`echo $LIBS | sed 's/-ldl //'`
-fi
-
 dnl Adding -Werror to CFLAGS early prevents configure tests from running.
 dnl Add now.
 CFLAGS="$CFLAGS $werror_flags"
 
 AC_EXEEXT
-AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openbsd-compat/Makefile \
+AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
+        openbsd-compat/Makefile openbsd-compat/regress/Makefile \
         scard/Makefile ssh_prng_cmds survey.sh])
 AC_OUTPUT
 
@@ -3824,6 +4012,7 @@ echo "          sshd superuser user PATH: $J"
 fi
 echo "                    Manpage format: $MANTYPE"
 echo "                       PAM support: $PAM_MSG"
+echo "                   OSF SIA support: $SIA_MSG"
 echo "                 KerberosV support: $KRB5_MSG"
 echo "                   SELinux support: $SELINUX_MSG"
 echo "                 Smartcard support: $SCARD_MSG"
@@ -3831,6 +4020,7 @@ echo "                     S/KEY support: $SKEY_MSG"
 echo "              TCP Wrappers support: $TCPW_MSG"
 echo "              MD5 password support: $MD5_MSG"
 echo "                   libedit support: $LIBEDIT_MSG"
+echo "  Solaris process contract support: $SPC_MSG"
 echo "       IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
 echo "           Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
 echo "                  BSD Auth support: $BSD_AUTH_MSG"