summaryrefslogtreecommitdiff
path: root/configure.ac
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2014-10-07 13:22:41 +0100
committerColin Watson <cjwatson@debian.org>2015-08-19 17:09:55 +0100
commitace4bfab52b31a2833636a243ba150fdf0f48293 (patch)
tree5b6fc34d23d98e75196a515d35dd1dfeb9710db6 /configure.ac
parent5d3dc7ea4c96cab9483d5389a3b04163771fdee2 (diff)
Restore TCP wrappers support
Support for TCP wrappers was dropped in OpenSSH 6.7. See this message and thread: https://lists.mindrot.org/pipermail/openssh-unix-dev/2014-April/032497.html It is true that this reduces preauth attack surface in sshd. On the other hand, this support seems to be quite widely used, and abruptly dropping it (from the perspective of users who don't read openssh-unix-dev) could easily cause more serious problems in practice. It's not entirely clear what the right long-term answer for Debian is, but it at least probably doesn't involve dropping this feature shortly before a freeze. Forwarded: not-needed Last-Update: 2014-10-07 Patch-Name: restore-tcp-wrappers.patch
Diffstat (limited to 'configure.ac')
-rw-r--r--configure.ac57
1 files changed, 57 insertions, 0 deletions
diff --git a/configure.ac b/configure.ac
index df2169375..4d55c46fc 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1448,6 +1448,62 @@ AC_ARG_WITH([skey],
1448 ] 1448 ]
1449) 1449)
1450 1450
1451# Check whether user wants TCP wrappers support
1452TCPW_MSG="no"
1453AC_ARG_WITH([tcp-wrappers],
1454 [ --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)],
1455 [
1456 if test "x$withval" != "xno" ; then
1457 saved_LIBS="$LIBS"
1458 saved_LDFLAGS="$LDFLAGS"
1459 saved_CPPFLAGS="$CPPFLAGS"
1460 if test -n "${withval}" && \
1461 test "x${withval}" != "xyes"; then
1462 if test -d "${withval}/lib"; then
1463 if test -n "${need_dash_r}"; then
1464 LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
1465 else
1466 LDFLAGS="-L${withval}/lib ${LDFLAGS}"
1467 fi
1468 else
1469 if test -n "${need_dash_r}"; then
1470 LDFLAGS="-L${withval} -R${withval} ${LDFLAGS}"
1471 else
1472 LDFLAGS="-L${withval} ${LDFLAGS}"
1473 fi
1474 fi
1475 if test -d "${withval}/include"; then
1476 CPPFLAGS="-I${withval}/include ${CPPFLAGS}"
1477 else
1478 CPPFLAGS="-I${withval} ${CPPFLAGS}"
1479 fi
1480 fi
1481 LIBS="-lwrap $LIBS"
1482 AC_MSG_CHECKING([for libwrap])
1483 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
1484#include <sys/types.h>
1485#include <sys/socket.h>
1486#include <netinet/in.h>
1487#include <tcpd.h>
1488int deny_severity = 0, allow_severity = 0;
1489 ]], [[
1490 hosts_access(0);
1491 ]])], [
1492 AC_MSG_RESULT([yes])
1493 AC_DEFINE([LIBWRAP], [1],
1494 [Define if you want
1495 TCP Wrappers support])
1496 SSHDLIBS="$SSHDLIBS -lwrap"
1497 TCPW_MSG="yes"
1498 ], [
1499 AC_MSG_ERROR([*** libwrap missing])
1500
1501 ])
1502 LIBS="$saved_LIBS"
1503 fi
1504 ]
1505)
1506
1451# Check whether user wants to use ldns 1507# Check whether user wants to use ldns
1452LDNS_MSG="no" 1508LDNS_MSG="no"
1453AC_ARG_WITH(ldns, 1509AC_ARG_WITH(ldns,
@@ -4928,6 +4984,7 @@ echo " KerberosV support: $KRB5_MSG"
4928echo " SELinux support: $SELINUX_MSG" 4984echo " SELinux support: $SELINUX_MSG"
4929echo " Smartcard support: $SCARD_MSG" 4985echo " Smartcard support: $SCARD_MSG"
4930echo " S/KEY support: $SKEY_MSG" 4986echo " S/KEY support: $SKEY_MSG"
4987echo " TCP Wrappers support: $TCPW_MSG"
4931echo " MD5 password support: $MD5_MSG" 4988echo " MD5 password support: $MD5_MSG"
4932echo " libedit support: $LIBEDIT_MSG" 4989echo " libedit support: $LIBEDIT_MSG"
4933echo " Solaris process contract support: $SPC_MSG" 4990echo " Solaris process contract support: $SPC_MSG"