1 files changed, 120 insertions, 15 deletions

diff --git a/configure.ac b/configure.ac
index a9eb8e76d..ba9d9a37a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.383 2007/08/10 04:36:12 dtucker Exp $
+# $Id: configure.ac,v 1.409 2008/07/09 11:07:19 djm Exp $
 #
 # Copyright (c) 1999-2004 Damien Miller
 #
@@ -15,7 +15,7 @@
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
-AC_REVISION($Revision: 1.383 $)
+AC_REVISION($Revision: 1.409 $)
 AC_CONFIG_SRCDIR([ssh.c])
 
 AC_CONFIG_HEADER(config.h)
@@ -90,6 +90,13 @@ AC_C_INLINE
 
 AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])
 
+use_stack_protector=1
+AC_ARG_WITH(stackprotect,
+    [  --without-stackprotect  Don't use compiler's stack protection], [
+    if test "x$withval" = "xno"; then
+        use_stack_protector=0
+    fi ])
+
 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
         CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
@@ -100,11 +107,61 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
                      no_attrib_nonnull=1
                      ;;
                 2.*) no_attrib_nonnull=1 ;;
-                3.*) CFLAGS="$CFLAGS -Wsign-compare" ;;
-                4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;;
+                3.*) CFLAGS="$CFLAGS -Wsign-compare -Wformat-security" ;;
+                4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign -Wformat-security" ;;
                 *) ;;
         esac
 
+        AC_MSG_CHECKING(if $CC accepts -fno-builtin-memset)
+        saved_CFLAGS="$CFLAGS"
+        CFLAGS="$CFLAGS -fno-builtin-memset"
+        AC_LINK_IFELSE( [AC_LANG_SOURCE([[
+#include <string.h>
+int main(void){char b[10]; memset(b, 0, sizeof(b));}
+                ]])],
+                [ AC_MSG_RESULT(yes) ],
+                [ AC_MSG_RESULT(no)
+                  CFLAGS="$saved_CFLAGS" ]
+)
+
+        # -fstack-protector-all doesn't always work for some GCC versions
+        # and/or platforms, so we test if we can.  If it's not supported
+        # on a give platform gcc will emit a warning so we use -Werror.
+        if test "x$use_stack_protector" = "x1"; then
+            for t in -fstack-protector-all -fstack-protector; do
+                AC_MSG_CHECKING(if $CC supports $t)
+                saved_CFLAGS="$CFLAGS"
+                saved_LDFLAGS="$LDFLAGS"
+                CFLAGS="$CFLAGS $t -Werror"
+                LDFLAGS="$LDFLAGS $t -Werror"
+                AC_LINK_IFELSE(
+                        [AC_LANG_SOURCE([
+#include <stdlib.h>
+int main(void){return 0;}
+                         ])],
+                    [ AC_MSG_RESULT(yes)
+                      CFLAGS="$saved_CFLAGS $t"
+                      LDFLAGS="$saved_LDFLAGS $t"
+                      AC_MSG_CHECKING(if $t works)
+                      AC_RUN_IFELSE(
+                        [AC_LANG_SOURCE([
+#include <stdlib.h>
+int main(void){exit(0);}
+                        ])],
+                        [ AC_MSG_RESULT(yes)
+                          break ],
+                        [ AC_MSG_RESULT(no) ],
+                        [ AC_MSG_WARN([cross compiling: cannot test])
+                          break ]
+                      )
+                    ],
+                    [ AC_MSG_RESULT(no) ]
+                )
+                CFLAGS="$saved_CFLAGS"
+                LDFLAGS="$saved_LDFLAGS"
+            done
+        fi
+
         if test -z "$have_llong_max"; then
                 # retry LLONG_MAX with -std=gnu99, needed on some Linuxes
                 unset ac_cv_have_decl_LLONG_MAX
@@ -222,7 +279,9 @@ AC_CHECK_HEADERS( \
         sys/cdefs.h \
         sys/dir.h \
         sys/mman.h \
+        sys/mount.h \
         sys/ndir.h \
+        sys/poll.h \
         sys/prctl.h \
         sys/pstat.h \
         sys/select.h \
@@ -230,6 +289,7 @@ AC_CHECK_HEADERS( \
         sys/stream.h \
         sys/stropts.h \
         sys/strtio.h \
+        sys/statvfs.h \
         sys/sysmacros.h \
         sys/time.h \
         sys/timers.h \
@@ -343,7 +403,7 @@ int main(void) { exit(0); }
                 [],
                 [#include <usersec.h>]
         )
-        AC_CHECK_FUNCS(setauthdb)
+        AC_CHECK_FUNCS(getgrset setauthdb)
         AC_CHECK_DECL(F_CLOSEM,
             AC_DEFINE(HAVE_FCNTL_CLOSEM, 1, [Use F_CLOSEM fcntl for closefrom]),
             [],
@@ -405,6 +465,7 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
         AC_DEFINE(SETEUID_BREAKS_SETUID)
         AC_DEFINE(BROKEN_SETREUID)
         AC_DEFINE(BROKEN_SETREGID)
+        AC_DEFINE(BROKEN_GLOB, 1, [OS X glob does not do what we expect])
         AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1,
                 [Define if your resolver libs need this for getrrsetbyname])
         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
@@ -436,7 +497,12 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
                 fi],
                 [AC_MSG_RESULT(no)]
         )
-        ;;
+        m4_pattern_allow(AU_IPv)
+        AC_CHECK_DECL(AU_IPv4, [], 
+            AC_DEFINE(AU_IPv4, 0, [System only supports IPv4 audit records])
+            [#include <bsm/audit.h>]
+        )
+        ;;
 *-*-dragonfly*)
         SSHDLIBS="$SSHDLIBS -lcrypt"
         ;;
@@ -523,7 +589,6 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
         no_dev_ptmx=1
         check_for_libcrypt_later=1
         check_for_openpty_ctty_bug=1
-        AC_DEFINE(DONT_TRY_OTHER_AF, 1, [Workaround more Linux IPv6 quirks])
         AC_DEFINE(PAM_TTY_KLUDGE, 1,
                 [Work around problematic Linux PAM modules handling of PAM_TTY])
         AC_DEFINE(LOCKED_PASSWD_PREFIX, "!",
@@ -573,6 +638,7 @@ mips-sony-bsd|mips-sony-newsos4)
         AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way])
         AC_CHECK_HEADER([net/if_tap.h], ,
             AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support]))
+        AC_DEFINE(BROKEN_GLOB, 1, [FreeBSD glob does not do what we need])
         ;;
 *-*-bsdi*)
         AC_DEFINE(SETEUID_BREAKS_SETUID)
@@ -799,6 +865,7 @@ mips-sony-bsd|mips-sony-newsos4)
         AC_DEFINE(SETEUID_BREAKS_SETUID)
         AC_DEFINE(BROKEN_SETREUID)
         AC_DEFINE(BROKEN_SETREGID)
+        AC_DEFINE(BROKEN_READV_COMPARISON, 1, [Can't do comparisons on readv])
         ;;
 
 *-*-nto-qnx*)
@@ -809,6 +876,7 @@ mips-sony-bsd|mips-sony-newsos4)
         AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems])
         AC_DEFINE(DISABLE_LASTLOG)
         AC_DEFINE(SSHD_ACQUIRES_CTTY)
+        AC_DEFINE(BROKEN_SHADOW_EXPIRE, 1, [QNX shadow support is broken])
         enable_etc_default_login=no     # has incompatible /etc/default/login
         case "$host" in
         *-*-nto-qnx6*)
@@ -1004,7 +1072,7 @@ dnl    Checks for libutil functions
 AC_CHECK_HEADERS(libutil.h)
 AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1,
         [Define if your libraries define login()])])
-AC_CHECK_FUNCS(logout updwtmp logwtmp)
+AC_CHECK_FUNCS(fmt_scaled logout updwtmp logwtmp)
 
 AC_FUNC_STRFTIME
 
@@ -1238,7 +1306,7 @@ AC_ARG_WITH(audit,
                 AC_CHECK_FUNCS(getaudit, [],
                     [AC_MSG_ERROR(BSM enabled and required function not found)])
                 # These are optional
-                AC_CHECK_FUNCS(getaudit_addr)
+                AC_CHECK_FUNCS(getaudit_addr aug_get_machine)
                 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
                 ;;
           debug)
@@ -1258,6 +1326,8 @@ AC_ARG_WITH(audit,
 dnl    Checks for library functions. Please keep in alphabetical order
 AC_CHECK_FUNCS( \
         arc4random \
+        arc4random_buf \
+        arc4random_uniform \
         asprintf \
         b64_ntop \
         __b64_ntop \
@@ -1271,6 +1341,7 @@ AC_CHECK_FUNCS( \
         fchmod \
         fchown \
         freeaddrinfo \
+        fstatvfs \
         futimes \
         getaddrinfo \
         getcwd \
@@ -1322,6 +1393,8 @@ AC_CHECK_FUNCS( \
         sigvec \
         snprintf \
         socketpair \
+        statfs \
+        statvfs \
         strdup \
         strerror \
         strlcat \
@@ -2028,7 +2101,10 @@ AC_CHECK_FUNCS(SHA256_Update EVP_sha256)
 saved_LIBS="$LIBS"
 AC_CHECK_LIB(iaf, ia_openinfo, [
         LIBS="$LIBS -liaf"
-        AC_CHECK_FUNCS(set_id, [SSHDLIBS="$SSHDLIBS -liaf"])
+        AC_CHECK_FUNCS(set_id, [SSHDLIBS="$SSHDLIBS -liaf"
+                                AC_DEFINE(HAVE_LIBIAF, 1,
+                        [Define if system has libiaf that supports set_id])
+                                ])
 ])
 LIBS="$saved_LIBS"
 
@@ -2612,6 +2688,18 @@ fi
 TYPE_SOCKLEN_T
 
 AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>])
+AC_CHECK_TYPES([fsblkcnt_t, fsfilcnt_t],,,[
+#include <sys/types.h>
+#ifdef HAVE_SYS_BITYPES_H
+#include <sys/bitypes.h>
+#endif
+#ifdef HAVE_SYS_STATFS_H
+#include <sys/statfs.h>
+#endif
+#ifdef HAVE_SYS_STATVFS_H
+#include <sys/statvfs.h>
+#endif
+])
 
 AC_CHECK_TYPES(in_addr_t,,,
 [#include <sys/types.h>
@@ -2974,6 +3062,16 @@ if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then
                 file descriptor passing])
 fi
 
+AC_MSG_CHECKING(if f_fsid has val members)
+AC_TRY_COMPILE([
+#include <sys/types.h>
+#include <sys/statvfs.h>],
+[struct fsid_t t; t.val[0] = 0;],
+        [ AC_MSG_RESULT(yes)
+          AC_DEFINE(FSID_HAS_VAL, 1, f_fsid has members) ],
+        [ AC_MSG_RESULT(no) ]
+)
+
 AC_CACHE_CHECK([for msg_control field in struct msghdr],
                 ac_cv_have_control_in_msghdr, [
         AC_COMPILE_IFELSE(
@@ -3225,7 +3323,7 @@ int main() { return 0; }
 SELINUX_MSG="no"
 LIBSELINUX=""
 AC_ARG_WITH(selinux,
-        [  --with-selinux   Enable SELinux support],
+        [  --with-selinux          Enable SELinux support],
         [ if test "x$withval" != "xno" ; then
                 save_LIBS="$LIBS"
                 AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
@@ -3302,12 +3400,12 @@ AC_ARG_WITH(kerberos5,
                         )
                         AC_SEARCH_LIBS(dn_expand, resolv)
 
-                        AC_CHECK_LIB(gssapi,gss_init_sec_context,
+                        AC_CHECK_LIB(gssapi_krb5, gss_init_sec_context,
                                 [ AC_DEFINE(GSSAPI)
-                                  K5LIBS="-lgssapi $K5LIBS" ],
-                                [ AC_CHECK_LIB(gssapi_krb5,gss_init_sec_context,
+                                  K5LIBS="-lgssapi_krb5 $K5LIBS" ],
+                                [ AC_CHECK_LIB(gssapi, gss_init_sec_context,
                                         [ AC_DEFINE(GSSAPI)
-                                          K5LIBS="-lgssapi_krb5 $K5LIBS" ],
+                                          K5LIBS="-lgssapi $K5LIBS" ],
                                         AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]),
                                         $K5LIBS)
                                 ],
@@ -4006,6 +4104,13 @@ dnl Adding -Werror to CFLAGS early prevents configure tests from running.
 dnl Add now.
 CFLAGS="$CFLAGS $werror_flags"
 
+if grep "#define BROKEN_GETADDRINFO 1" confdefs.h >/dev/null || \
+    test "x$ac_cv_func_getaddrinfo" != "xyes" ; then
+        AC_SUBST(TEST_SSH_IPV6, no)
+else
+        AC_SUBST(TEST_SSH_IPV6, yes)
+fi
+
 AC_EXEEXT
 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
         openbsd-compat/Makefile openbsd-compat/regress/Makefile \