summaryrefslogtreecommitdiff
path: root/configure.ac
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2014-10-07 13:22:41 +0100
committerColin Watson <cjwatson@debian.org>2016-03-21 12:06:15 +0000
commit0031968609564a15294c39d2519201741664905d (patch)
treed1f6e45b3bea10787e369e0fe0f9871f88bd3b89 /configure.ac
parent8c27af53099b50387dda97c0aae36194197186f6 (diff)
Restore TCP wrappers support
Support for TCP wrappers was dropped in OpenSSH 6.7. See this message and thread: https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html It is true that this reduces preauth attack surface in sshd. On the other hand, this support seems to be quite widely used, and abruptly dropping it (from the perspective of users who don't read openssh-unix-dev) could easily cause more serious problems in practice. It's not entirely clear what the right long-term answer for Debian is, but it at least probably doesn't involve dropping this feature shortly before a freeze. Forwarded: not-needed Last-Update: 2014-10-07 Patch-Name: restore-tcp-wrappers.patch
Diffstat (limited to 'configure.ac')
-rw-r--r--configure.ac57
1 files changed, 57 insertions, 0 deletions
diff --git a/configure.ac b/configure.ac
index 5f1ff740f..5d720f77a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1481,6 +1481,62 @@ AC_ARG_WITH([skey],
1481 ] 1481 ]
1482) 1482)
1483 1483
1484# Check whether user wants TCP wrappers support
1485TCPW_MSG="no"
1486AC_ARG_WITH([tcp-wrappers],
1487 [ --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1488 [
1489 if test "x$withval" != "xno" ; then
1490 saved_LIBS="$LIBS"
1491 saved_LDFLAGS="$LDFLAGS"
1492 saved_CPPFLAGS="$CPPFLAGS"
1493 if test -n "${withval}" && \
1494 test "x${withval}" != "xyes"; then
1495 if test -d "${withval}/lib"; then
1496 if test -n "${need_dash_r}"; then
1497 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1498 else
1499 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1500 fi
1501 else
1502 if test -n "${need_dash_r}"; then
1503 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1504 else
1505 LDFLAGS="-L${withval} ${LDFLAGS}"
1506 fi
1507 fi
1508 if test -d "${withval}/include"; then
1509 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1510 else
1511 CPPFLAGS="-I${withval} ${CPPFLAGS}"
1512 fi
1513 fi
1514 LIBS="-lwrap $LIBS"
1515 AC_MSG_CHECKING([for libwrap])
1516 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
1517#include <sys/types.h>
1518#include <sys/socket.h>
1519#include <netinet/in.h>
1520#include <tcpd.h>
1521int deny_severity = 0, allow_severity = 0;
1522 ]], [[
1523 hosts_access(0);
1524 ]])], [
1525 AC_MSG_RESULT([yes])
1526 AC_DEFINE([LIBWRAP], [1],
1527 [Define if you want
1528 TCP Wrappers support])
1529 SSHDLIBS="$SSHDLIBS -lwrap"
1530 TCPW_MSG="yes"
1531 ], [
1532 AC_MSG_ERROR([*** libwrap missing])
1533
1534 ])
1535 LIBS="$saved_LIBS"
1536 fi
1537 ]
1538)
1539
1484# Check whether user wants to use ldns 1540# Check whether user wants to use ldns
1485LDNS_MSG="no" 1541LDNS_MSG="no"
1486AC_ARG_WITH(ldns, 1542AC_ARG_WITH(ldns,
@@ -5003,6 +5059,7 @@ echo " KerberosV support: $KRB5_MSG"
5003echo " SELinux support: $SELINUX_MSG" 5059echo " SELinux support: $SELINUX_MSG"
5004echo " Smartcard support: $SCARD_MSG" 5060echo " Smartcard support: $SCARD_MSG"
5005echo " S/KEY support: $SKEY_MSG" 5061echo " S/KEY support: $SKEY_MSG"
5062echo " TCP Wrappers support: $TCPW_MSG"
5006echo " MD5 password support: $MD5_MSG" 5063echo " MD5 password support: $MD5_MSG"
5007echo " libedit support: $LIBEDIT_MSG" 5064echo " libedit support: $LIBEDIT_MSG"
5008echo " Solaris process contract support: $SPC_MSG" 5065echo " Solaris process contract support: $SPC_MSG"