summaryrefslogtreecommitdiff
path: root/configure.ac
diff options
context:
space:
mode:
Diffstat (limited to 'configure.ac')
-rw-r--r--configure.ac106
1 files changed, 61 insertions, 45 deletions
diff --git a/configure.ac b/configure.ac
index 9d89bc351..483a9038c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -109,13 +109,10 @@ AC_CHECK_DECL([PR_SET_NO_NEW_PRIVS], [have_linux_no_new_privs=1], , [
109]) 109])
110 110
111openssl=yes 111openssl=yes
112ssh1=no
113COMMENT_OUT_RSA1="#no ssh1#"
114AC_ARG_WITH([openssl], 112AC_ARG_WITH([openssl],
115 [ --without-openssl Disable use of OpenSSL; use only limited internal crypto **EXPERIMENTAL** ], 113 [ --without-openssl Disable use of OpenSSL; use only limited internal crypto **EXPERIMENTAL** ],
116 [ if test "x$withval" = "xno" ; then 114 [ if test "x$withval" = "xno" ; then
117 openssl=no 115 openssl=no
118 ssh1=no
119 fi 116 fi
120 ] 117 ]
121) 118)
@@ -127,31 +124,6 @@ else
127 AC_MSG_RESULT([no]) 124 AC_MSG_RESULT([no])
128fi 125fi
129 126
130AC_ARG_WITH([ssh1],
131 [ --with-ssh1 Enable support for SSH protocol 1],
132 [
133 if test "x$withval" = "xyes" ; then
134 if test "x$openssl" = "xno" ; then
135 AC_MSG_ERROR([Cannot enable SSH protocol 1 with OpenSSL disabled])
136 fi
137 ssh1=yes
138 COMMENT_OUT_RSA1=""
139 elif test "x$withval" = "xno" ; then
140 ssh1=no
141 else
142 AC_MSG_ERROR([unknown --with-ssh1 argument])
143 fi
144 ]
145)
146AC_MSG_CHECKING([whether SSH protocol 1 support is enabled])
147if test "x$ssh1" = "xyes" ; then
148 AC_MSG_RESULT([yes])
149 AC_DEFINE_UNQUOTED([WITH_SSH1], [1], [include SSH protocol version 1 support])
150 AC_SUBST([COMMENT_OUT_RSA1])
151else
152 AC_MSG_RESULT([no])
153fi
154
155use_stack_protector=1 127use_stack_protector=1
156use_toolchain_hardening=1 128use_toolchain_hardening=1
157AC_ARG_WITH([stackprotect], 129AC_ARG_WITH([stackprotect],
@@ -179,6 +151,7 @@ AC_COMPILE_IFELSE([AC_LANG_SOURCE([[int main(void) { return 0; }]])],
179CFLAGS="$saved_CFLAGS" 151CFLAGS="$saved_CFLAGS"
180 152
181if test "$GCC" = "yes" || test "$GCC" = "egcs"; then 153if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
154 OSSH_CHECK_CFLAG_COMPILE([-pipe])
182 OSSH_CHECK_CFLAG_COMPILE([-Qunused-arguments]) 155 OSSH_CHECK_CFLAG_COMPILE([-Qunused-arguments])
183 OSSH_CHECK_CFLAG_COMPILE([-Wunknown-warning-option]) 156 OSSH_CHECK_CFLAG_COMPILE([-Wunknown-warning-option])
184 OSSH_CHECK_CFLAG_COMPILE([-Wall]) 157 OSSH_CHECK_CFLAG_COMPILE([-Wall])
@@ -190,8 +163,8 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
190 OSSH_CHECK_CFLAG_COMPILE([-Wpointer-sign], [-Wno-pointer-sign]) 163 OSSH_CHECK_CFLAG_COMPILE([-Wpointer-sign], [-Wno-pointer-sign])
191 OSSH_CHECK_CFLAG_COMPILE([-Wunused-result], [-Wno-unused-result]) 164 OSSH_CHECK_CFLAG_COMPILE([-Wunused-result], [-Wno-unused-result])
192 OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing]) 165 OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing])
193 OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2])
194 if test "x$use_toolchain_hardening" = "x1"; then 166 if test "x$use_toolchain_hardening" = "x1"; then
167 OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2])
195 OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro]) 168 OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro])
196 OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now]) 169 OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now])
197 OSSH_CHECK_LDFLAG_LINK([-Wl,-z,noexecstack]) 170 OSSH_CHECK_LDFLAG_LINK([-Wl,-z,noexecstack])
@@ -316,6 +289,16 @@ AC_ARG_WITH([cflags],
316 fi 289 fi
317 ] 290 ]
318) 291)
292
293AC_ARG_WITH([cflags-after],
294 [ --with-cflags-after Specify additional flags to pass to compiler after configure],
295 [
296 if test -n "$withval" && test "x$withval" != "xno" && \
297 test "x${withval}" != "xyes"; then
298 CFLAGS_AFTER="$withval"
299 fi
300 ]
301)
319AC_ARG_WITH([cppflags], 302AC_ARG_WITH([cppflags],
320 [ --with-cppflags Specify additional flags to pass to preprocessor] , 303 [ --with-cppflags Specify additional flags to pass to preprocessor] ,
321 [ 304 [
@@ -334,6 +317,15 @@ AC_ARG_WITH([ldflags],
334 fi 317 fi
335 ] 318 ]
336) 319)
320AC_ARG_WITH([ldflags-after],
321 [ --with-ldflags-after Specify additional flags to pass to linker after configure],
322 [
323 if test -n "$withval" && test "x$withval" != "xno" && \
324 test "x${withval}" != "xyes"; then
325 LDFLAGS_AFTER="$withval"
326 fi
327 ]
328)
337AC_ARG_WITH([libs], 329AC_ARG_WITH([libs],
338 [ --with-libs Specify additional libraries to link with], 330 [ --with-libs Specify additional libraries to link with],
339 [ 331 [
@@ -397,7 +389,6 @@ AC_CHECK_HEADERS([ \
397 sys/audit.h \ 389 sys/audit.h \
398 sys/bitypes.h \ 390 sys/bitypes.h \
399 sys/bsdtty.h \ 391 sys/bsdtty.h \
400 sys/capability.h \
401 sys/cdefs.h \ 392 sys/cdefs.h \
402 sys/dir.h \ 393 sys/dir.h \
403 sys/mman.h \ 394 sys/mman.h \
@@ -429,6 +420,13 @@ AC_CHECK_HEADERS([ \
429 wchar.h \ 420 wchar.h \
430]) 421])
431 422
423# sys/capsicum.h requires sys/types.h
424AC_CHECK_HEADERS([sys/capsicum.h], [], [], [
425#ifdef HAVE_SYS_TYPES_H
426# include <sys/types.h>
427#endif
428])
429
432# lastlog.h requires sys/time.h to be included first on Solaris 430# lastlog.h requires sys/time.h to be included first on Solaris
433AC_CHECK_HEADERS([lastlog.h], [], [], [ 431AC_CHECK_HEADERS([lastlog.h], [], [], [
434#ifdef HAVE_SYS_TIME_H 432#ifdef HAVE_SYS_TIME_H
@@ -1031,6 +1029,7 @@ mips-sony-bsd|mips-sony-newsos4)
1031 AC_DEFINE([BROKEN_SETREUID]) 1029 AC_DEFINE([BROKEN_SETREUID])
1032 AC_DEFINE([BROKEN_SETREGID]) 1030 AC_DEFINE([BROKEN_SETREGID])
1033 AC_DEFINE([PASSWD_NEEDS_USERNAME]) 1031 AC_DEFINE([PASSWD_NEEDS_USERNAME])
1032 AC_DEFINE([BROKEN_TCGETATTR_ICANON])
1034 TEST_SHELL=$SHELL # let configure find us a capable shell 1033 TEST_SHELL=$SHELL # let configure find us a capable shell
1035 case "$host" in 1034 case "$host" in
1036 *-*-sysv5SCO_SV*) # SCO OpenServer 6.x 1035 *-*-sysv5SCO_SV*) # SCO OpenServer 6.x
@@ -1356,7 +1355,17 @@ AC_CHECK_FUNCS([fmt_scaled scan_scaled login logout openpty updwtmp logwtmp])
1356AC_SEARCH_LIBS([inet_ntop], [resolv nsl]) 1355AC_SEARCH_LIBS([inet_ntop], [resolv nsl])
1357AC_SEARCH_LIBS([gethostbyname], [resolv nsl]) 1356AC_SEARCH_LIBS([gethostbyname], [resolv nsl])
1358 1357
1358# "Particular Function Checks"
1359# see https://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Particular-Functions.html
1359AC_FUNC_STRFTIME 1360AC_FUNC_STRFTIME
1361AC_FUNC_MALLOC
1362AC_FUNC_REALLOC
1363# autoconf doesn't have AC_FUNC_CALLOC so fake it if malloc returns NULL;
1364if test "x$ac_cv_func_malloc_0_nonnull" != "xyes"; then
1365 AC_DEFINE(HAVE_CALLOC, 0, [calloc(x, 0) returns NULL])
1366 AC_DEFINE(calloc, rpl_calloc,
1367 [Define to rpl_calloc if the replacement function should be used.])
1368fi
1360 1369
1361# Check for ALTDIRFUNC glob() extension 1370# Check for ALTDIRFUNC glob() extension
1362AC_MSG_CHECKING([for GLOB_ALTDIRFUNC support]) 1371AC_MSG_CHECKING([for GLOB_ALTDIRFUNC support])
@@ -1566,6 +1575,7 @@ AC_ARG_WITH(ldns,
1566 else 1575 else
1567 LIBS="$LIBS `$LDNSCONFIG --libs`" 1576 LIBS="$LIBS `$LDNSCONFIG --libs`"
1568 CPPFLAGS="$CPPFLAGS `$LDNSCONFIG --cflags`" 1577 CPPFLAGS="$CPPFLAGS `$LDNSCONFIG --cflags`"
1578 ldns=yes
1569 fi 1579 fi
1570 elif test "x$withval" != "xno" ; then 1580 elif test "x$withval" != "xno" ; then
1571 CPPFLAGS="$CPPFLAGS -I${withval}/include" 1581 CPPFLAGS="$CPPFLAGS -I${withval}/include"
@@ -1776,6 +1786,7 @@ AC_CHECK_FUNCS([ \
1776 fchmod \ 1786 fchmod \
1777 fchown \ 1787 fchown \
1778 freeaddrinfo \ 1788 freeaddrinfo \
1789 freezero \
1779 fstatfs \ 1790 fstatfs \
1780 fstatvfs \ 1791 fstatvfs \
1781 futimes \ 1792 futimes \
@@ -1784,6 +1795,7 @@ AC_CHECK_FUNCS([ \
1784 getgrouplist \ 1795 getgrouplist \
1785 getnameinfo \ 1796 getnameinfo \
1786 getopt \ 1797 getopt \
1798 getpagesize \
1787 getpeereid \ 1799 getpeereid \
1788 getpeerucred \ 1800 getpeerucred \
1789 getpgid \ 1801 getpgid \
@@ -1814,6 +1826,7 @@ AC_CHECK_FUNCS([ \
1814 readpassphrase \ 1826 readpassphrase \
1815 reallocarray \ 1827 reallocarray \
1816 recvmsg \ 1828 recvmsg \
1829 recallocarray \
1817 rresvport_af \ 1830 rresvport_af \
1818 sendmsg \ 1831 sendmsg \
1819 setdtablesize \ 1832 setdtablesize \
@@ -1847,6 +1860,7 @@ AC_CHECK_FUNCS([ \
1847 strnlen \ 1860 strnlen \
1848 strnvis \ 1861 strnvis \
1849 strptime \ 1862 strptime \
1863 strsignal \
1850 strtonum \ 1864 strtonum \
1851 strtoll \ 1865 strtoll \
1852 strtoul \ 1866 strtoul \
@@ -2615,7 +2629,11 @@ if test "x$openssl" = "xyes" ; then
2615 10000*|0*) 2629 10000*|0*)
2616 AC_MSG_ERROR([OpenSSL >= 1.0.1 required (have "$ssl_library_ver")]) 2630 AC_MSG_ERROR([OpenSSL >= 1.0.1 required (have "$ssl_library_ver")])
2617 ;; 2631 ;;
2618 *) ;; 2632 100*) ;; # 1.0.x
2633 200*) ;; # LibreSSL
2634 *)
2635 AC_MSG_ERROR([OpenSSL >= 1.1.0 is not yet supported (have "$ssl_library_ver")])
2636 ;;
2619 esac 2637 esac
2620 AC_MSG_RESULT([$ssl_library_ver]) 2638 AC_MSG_RESULT([$ssl_library_ver])
2621 ], 2639 ],
@@ -2848,9 +2866,6 @@ if test "x$openssl" = "xyes" ; then
2848 #include <openssl/evp.h> 2866 #include <openssl/evp.h>
2849 #include <openssl/objects.h> 2867 #include <openssl/objects.h>
2850 #include <openssl/opensslv.h> 2868 #include <openssl/opensslv.h>
2851 #if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
2852 # error "OpenSSL < 0.9.8g has unreliable ECC code"
2853 #endif
2854 ]], [[ 2869 ]], [[
2855 EC_KEY *e = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); 2870 EC_KEY *e = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
2856 const EVP_MD *m = EVP_sha256(); /* We need this too */ 2871 const EVP_MD *m = EVP_sha256(); /* We need this too */
@@ -2869,9 +2884,6 @@ if test "x$openssl" = "xyes" ; then
2869 #include <openssl/evp.h> 2884 #include <openssl/evp.h>
2870 #include <openssl/objects.h> 2885 #include <openssl/objects.h>
2871 #include <openssl/opensslv.h> 2886 #include <openssl/opensslv.h>
2872 #if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
2873 # error "OpenSSL < 0.9.8g has unreliable ECC code"
2874 #endif
2875 ]], [[ 2887 ]], [[
2876 EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp384r1); 2888 EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp384r1);
2877 const EVP_MD *m = EVP_sha384(); /* We need this too */ 2889 const EVP_MD *m = EVP_sha384(); /* We need this too */
@@ -2890,9 +2902,6 @@ if test "x$openssl" = "xyes" ; then
2890 #include <openssl/evp.h> 2902 #include <openssl/evp.h>
2891 #include <openssl/objects.h> 2903 #include <openssl/objects.h>
2892 #include <openssl/opensslv.h> 2904 #include <openssl/opensslv.h>
2893 #if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
2894 # error "OpenSSL < 0.9.8g has unreliable ECC code"
2895 #endif
2896 ]], [[ 2905 ]], [[
2897 EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1); 2906 EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
2898 const EVP_MD *m = EVP_sha512(); /* We need this too */ 2907 const EVP_MD *m = EVP_sha512(); /* We need this too */
@@ -3277,7 +3286,8 @@ AC_RUN_IFELSE(
3277 select_works_with_rlimit=yes], 3286 select_works_with_rlimit=yes],
3278 [AC_MSG_RESULT([no]) 3287 [AC_MSG_RESULT([no])
3279 select_works_with_rlimit=no], 3288 select_works_with_rlimit=no],
3280 [AC_MSG_WARN([cross compiling: assuming yes])] 3289 [AC_MSG_WARN([cross compiling: assuming yes])
3290 select_works_with_rlimit=yes]
3281) 3291)
3282 3292
3283AC_MSG_CHECKING([if setrlimit(RLIMIT_NOFILE,{0,0}) works]) 3293AC_MSG_CHECKING([if setrlimit(RLIMIT_NOFILE,{0,0}) works])
@@ -3303,7 +3313,8 @@ AC_RUN_IFELSE(
3303 rlimit_nofile_zero_works=yes], 3313 rlimit_nofile_zero_works=yes],
3304 [AC_MSG_RESULT([no]) 3314 [AC_MSG_RESULT([no])
3305 rlimit_nofile_zero_works=no], 3315 rlimit_nofile_zero_works=no],
3306 [AC_MSG_WARN([cross compiling: assuming yes])] 3316 [AC_MSG_WARN([cross compiling: assuming yes])
3317 rlimit_nofile_zero_works=yes]
3307) 3318)
3308 3319
3309AC_MSG_CHECKING([if setrlimit RLIMIT_FSIZE works]) 3320AC_MSG_CHECKING([if setrlimit RLIMIT_FSIZE works])
@@ -3366,10 +3377,10 @@ elif test "x$sandbox_arg" = "xseccomp_filter" || \
3366 AC_DEFINE([SANDBOX_SECCOMP_FILTER], [1], [Sandbox using seccomp filter]) 3377 AC_DEFINE([SANDBOX_SECCOMP_FILTER], [1], [Sandbox using seccomp filter])
3367elif test "x$sandbox_arg" = "xcapsicum" || \ 3378elif test "x$sandbox_arg" = "xcapsicum" || \
3368 ( test -z "$sandbox_arg" && \ 3379 ( test -z "$sandbox_arg" && \
3369 test "x$ac_cv_header_sys_capability_h" = "xyes" && \ 3380 test "x$ac_cv_header_sys_capsicum_h" = "xyes" && \
3370 test "x$ac_cv_func_cap_rights_limit" = "xyes") ; then 3381 test "x$ac_cv_func_cap_rights_limit" = "xyes") ; then
3371 test "x$ac_cv_header_sys_capability_h" != "xyes" && \ 3382 test "x$ac_cv_header_sys_capsicum_h" != "xyes" && \
3372 AC_MSG_ERROR([capsicum sandbox requires sys/capability.h header]) 3383 AC_MSG_ERROR([capsicum sandbox requires sys/capsicum.h header])
3373 test "x$ac_cv_func_cap_rights_limit" != "xyes" && \ 3384 test "x$ac_cv_func_cap_rights_limit" != "xyes" && \
3374 AC_MSG_ERROR([capsicum sandbox requires cap_rights_limit function]) 3385 AC_MSG_ERROR([capsicum sandbox requires cap_rights_limit function])
3375 SANDBOX_STYLE="capsicum" 3386 SANDBOX_STYLE="capsicum"
@@ -3925,6 +3936,8 @@ OSSH_CHECK_HEADER_FOR_FIELD([ut_time], [utmpx.h], [HAVE_TIME_IN_UTMPX])
3925OSSH_CHECK_HEADER_FOR_FIELD([ut_tv], [utmpx.h], [HAVE_TV_IN_UTMPX]) 3936OSSH_CHECK_HEADER_FOR_FIELD([ut_tv], [utmpx.h], [HAVE_TV_IN_UTMPX])
3926 3937
3927AC_CHECK_MEMBERS([struct stat.st_blksize]) 3938AC_CHECK_MEMBERS([struct stat.st_blksize])
3939AC_CHECK_MEMBERS([struct stat.st_mtim])
3940AC_CHECK_MEMBERS([struct stat.st_mtime])
3928AC_CHECK_MEMBERS([struct passwd.pw_gecos, struct passwd.pw_class, 3941AC_CHECK_MEMBERS([struct passwd.pw_gecos, struct passwd.pw_class,
3929struct passwd.pw_change, struct passwd.pw_expire], 3942struct passwd.pw_change, struct passwd.pw_expire],
3930[], [], [[ 3943[], [], [[
@@ -5147,6 +5160,9 @@ AC_SUBST([TEST_SSH_UTF8], [$TEST_SSH_UTF8])
5147AC_SUBST([TEST_MALLOC_OPTIONS], [$TEST_MALLOC_OPTIONS]) 5160AC_SUBST([TEST_MALLOC_OPTIONS], [$TEST_MALLOC_OPTIONS])
5148AC_SUBST([UNSUPPORTED_ALGORITHMS], [$unsupported_algorithms]) 5161AC_SUBST([UNSUPPORTED_ALGORITHMS], [$unsupported_algorithms])
5149 5162
5163CFLAGS="${CFLAGS} ${CFLAGS_AFTER}"
5164LDFLAGS="${LDFLAGS} ${LDFLAGS_AFTER}"
5165
5150AC_EXEEXT 5166AC_EXEEXT
5151AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \ 5167AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
5152 openbsd-compat/Makefile openbsd-compat/regress/Makefile \ 5168 openbsd-compat/Makefile openbsd-compat/regress/Makefile \