1 files changed, 269 insertions, 39 deletions

diff --git a/configure.ac b/configure.ac
index d7d500a33..e2289cd37 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.536 2013/08/04 11:48:41 dtucker Exp $
+# $Id: configure.ac,v 1.568 2014/01/30 00:26:46 djm Exp $
 #
 # Copyright (c) 1999-2004 Damien Miller
 #
@@ -15,7 +15,7 @@
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 
 AC_INIT([OpenSSH], [Portable], [openssh-unix-dev@mindrot.org])
-AC_REVISION($Revision: 1.536 $)
+AC_REVISION($Revision: 1.568 $)
 AC_CONFIG_SRCDIR([ssh.c])
 AC_LANG([C])
 
@@ -120,19 +120,36 @@ AC_CHECK_DECL([PR_SET_NO_NEW_PRIVS], [have_linux_no_new_privs=1], , [
         #include <sys/types.h>
         #include <linux/prctl.h>
 ])
+
 use_stack_protector=1
+use_toolchain_hardening=1
 AC_ARG_WITH([stackprotect],
     [  --without-stackprotect  Don't use compiler's stack protection], [
     if test "x$withval" = "xno"; then
         use_stack_protector=0
     fi ])
+AC_ARG_WITH([hardening],
+    [  --without-hardening     Don't use toolchain hardening flags], [
+    if test "x$withval" = "xno"; then
+        use_toolchain_hardening=0
+    fi ])
 
+# We use -Werror for the tests only so that we catch warnings like "this is
+# on by default" for things like -fPIE.
+AC_MSG_CHECKING([if $CC supports -Werror])
+saved_CFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS -Werror"
+AC_COMPILE_IFELSE([AC_LANG_SOURCE([[int main(void) { return 0; }]])],
+        [ AC_MSG_RESULT([yes])
+          WERROR="-Werror"],
+        [ AC_MSG_RESULT([no])
+          WERROR="" ]
+)
+CFLAGS="$saved_CFLAGS"
 
 if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
-        OSSH_CHECK_CFLAG_COMPILE([-Qunused-arguments -Werror],
-            [-Qunused-arguments])
-        OSSH_CHECK_CFLAG_COMPILE([-Wunknown-warning-option -Werror],
-            [-Wno-unknown-warning-option])
+        OSSH_CHECK_CFLAG_COMPILE([-Qunused-arguments])
+        OSSH_CHECK_CFLAG_COMPILE([-Wunknown-warning-option])
         OSSH_CHECK_CFLAG_COMPILE([-Wall])
         OSSH_CHECK_CFLAG_COMPILE([-Wpointer-arith])
         OSSH_CHECK_CFLAG_COMPILE([-Wuninitialized])
@@ -143,6 +160,17 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
         OSSH_CHECK_CFLAG_COMPILE([-Wunused-result], [-Wno-unused-result])
         OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing])
         OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2])
+    if test "x$use_toolchain_hardening" = "x1"; then
+        OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro])
+        OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now])
+        OSSH_CHECK_LDFLAG_LINK([-Wl,-z,noexecstack])
+        # NB. -ftrapv expects certain support functions to be present in
+        # the compiler library (libgcc or similar) to detect integer operations
+        # that can overflow. We must check that the result of enabling it
+        # actually links. The test program compiled/linked includes a number
+        # of integer operations that should exercise this.
+        OSSH_CHECK_CFLAG_LINK([-ftrapv])
+    fi
         AC_MSG_CHECKING([gcc version])
         GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
         case $GCC_VER in
@@ -169,7 +197,8 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
         # and/or platforms, so we test if we can.  If it's not supported
         # on a given platform gcc will emit a warning so we use -Werror.
         if test "x$use_stack_protector" = "x1"; then
-            for t in -fstack-protector-all -fstack-protector; do
+            for t in -fstack-protector-strong -fstack-protector-all \
+                    -fstack-protector; do
                 AC_MSG_CHECKING([if $CC supports $t])
                 saved_CFLAGS="$CFLAGS"
                 saved_LDFLAGS="$LDFLAGS"
@@ -296,6 +325,7 @@ AC_ARG_WITH([Werror],
 )
 
 AC_CHECK_HEADERS([ \
+        blf.h \
         bstring.h \
         crypt.h \
         crypto/sha2.h \
@@ -309,6 +339,7 @@ AC_CHECK_HEADERS([ \
         glob.h \
         ia.h \
         iaf.h \
+        inttypes.h \
         limits.h \
         locale.h \
         login.h \
@@ -333,6 +364,7 @@ AC_CHECK_HEADERS([ \
         sys/audit.h \
         sys/bitypes.h \
         sys/bsdtty.h \
+        sys/capability.h \
         sys/cdefs.h \
         sys/dir.h \
         sys/mman.h \
@@ -513,7 +545,10 @@ case "$host" in
                 [Define if your platform needs to skip post auth
                 file descriptor passing])
         AC_DEFINE([SSH_IOBUFSZ], [65535], [Windows is sensitive to read buffer size])
-        AC_DEFINE([FILESYSTEM_NO_BACKSLASH], [1], [File names may not contain backslash characters]) 
+        AC_DEFINE([FILESYSTEM_NO_BACKSLASH], [1], [File names may not contain backslash characters])
+        # Cygwin defines optargs, optargs as declspec(dllimport) for historical
+        # reasons which cause compile warnings, so we disable those warnings.
+        OSSH_CHECK_CFLAG_COMPILE([-Wno-attributes])
         ;;
 *-*-dgux*)
         AC_DEFINE([IP_TOS_IS_BROKEN], [1],
@@ -523,6 +558,7 @@ case "$host" in
         AC_DEFINE([BROKEN_SETREGID])
         ;;
 *-*-darwin*)
+        use_pie=auto
         AC_MSG_CHECKING([if we have working getaddrinfo])
         AC_RUN_IFELSE([AC_LANG_SOURCE([[ #include <mach-o/dyld.h>
 main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
@@ -587,6 +623,7 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
         ;;
 *-*-dragonfly*)
         SSHDLIBS="$SSHDLIBS -lcrypt"
+        TEST_MALLOC_OPTIONS="AFGJPRX"
         ;;
 *-*-haiku*) 
     LIBS="$LIBS -lbsd "
@@ -684,6 +721,7 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
         ;;
 *-*-linux*)
         no_dev_ptmx=1
+        use_pie=auto
         check_for_libcrypt_later=1
         check_for_openpty_ctty_bug=1
         AC_DEFINE([PAM_TTY_KLUDGE], [1],
@@ -752,6 +790,11 @@ mips-sony-bsd|mips-sony-newsos4)
             AC_DEFINE([SSH_TUN_NO_L2], [1], [No layer 2 tunnel support]))
         AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
             [Prepend the address family to IP tunnel traffic])
+        TEST_MALLOC_OPTIONS="AJRX"
+        AC_DEFINE([BROKEN_STRNVIS], [1],
+            [NetBSD strnvis argument order is swapped compared to OpenBSD])
+        AC_DEFINE([BROKEN_READ_COMPARISON], [1],
+            [NetBSD read function is sometimes redirected, breaking atomicio comparisons against it])
         ;;
 *-*-freebsd*)
         check_for_libcrypt_later=1
@@ -760,7 +803,13 @@ mips-sony-bsd|mips-sony-newsos4)
         AC_CHECK_HEADER([net/if_tap.h], ,
             AC_DEFINE([SSH_TUN_NO_L2], [1], [No layer 2 tunnel support]))
         AC_DEFINE([BROKEN_GLOB], [1], [FreeBSD glob does not do what we need])
-        AC_DEFINE([BROKEN_STRNVIS], [1], [FreeBSD strnvis does not do what we need])
+        AC_DEFINE([BROKEN_STRNVIS], [1],
+            [FreeBSD strnvis argument order is swapped compared to OpenBSD])
+        TEST_MALLOC_OPTIONS="AJRX"
+        # Preauth crypto occasionally uses file descriptors for crypto offload
+        # and will crash if they cannot be opened.
+        AC_DEFINE([SANDBOX_SKIP_RLIMIT_NOFILE], [1],
+            [define if setrlimit RLIMIT_NOFILE breaks things])],
         ;;
 *-*-bsdi*)
         AC_DEFINE([SETEUID_BREAKS_SETUID])
@@ -778,11 +827,13 @@ mips-sony-bsd|mips-sony-newsos4)
         AC_DEFINE([BROKEN_SAVED_UIDS], [1], [Needed for NeXT])
         ;;
 *-*-openbsd*)
+        use_pie=auto
         AC_DEFINE([HAVE_ATTRIBUTE__SENTINEL__], [1], [OpenBSD's gcc has sentinel])
         AC_DEFINE([HAVE_ATTRIBUTE__BOUNDED__], [1], [OpenBSD's gcc has bounded])
         AC_DEFINE([SSH_TUN_OPENBSD], [1], [Open tunnel devices the OpenBSD way])
         AC_DEFINE([SYSLOG_R_SAFE_IN_SIGHAND], [1],
             [syslog_r function is safe to use in in a signal handler])
+        TEST_MALLOC_OPTIONS="AFGJPRX"
         ;;
 *-*-solaris*)
         if test "x$withval" != "xno" ; then
@@ -1215,6 +1266,9 @@ AC_SEARCH_LIBS([openpty], [util bsd])
 AC_SEARCH_LIBS([updwtmp], [util bsd])
 AC_CHECK_FUNCS([fmt_scaled scan_scaled login logout openpty updwtmp logwtmp])
 
+# On some platforms, inet_ntop may be found in libresolv or libnsl.
+AC_SEARCH_LIBS([inet_ntop], [resolv nsl])
+
 AC_FUNC_STRFTIME
 
 # Check for ALTDIRFUNC glob() extension
@@ -1466,7 +1520,7 @@ AC_ARG_WITH([libedit],
                         fi
                 fi
                 if test "x$use_pkgconfig_for_libedit" = "xyes"; then
-                        LIBEDIT=`$PKGCONFIG --libs-only-l libedit`
+                        LIBEDIT=`$PKGCONFIG --libs libedit`
                         CPPFLAGS="$CPPFLAGS `$PKGCONFIG --cflags libedit`"
                 else
                         LIBEDIT="-ledit -lcurses"
@@ -1520,7 +1574,7 @@ AC_ARG_WITH([audit],
                 # These are optional
                 AC_CHECK_FUNCS([getaudit_addr aug_get_machine])
                 AC_DEFINE([USE_BSM_AUDIT], [1], [Use BSM audit module])
-                if test "$sol2ver" -eq 11; then
+                if test "$sol2ver" -ge 11; then
                         SSHDLIBS="$SSHDLIBS -lscf"
                         AC_DEFINE([BROKEN_BSM_API], [1], 
                                   [The system has incomplete BSM API])
@@ -1548,10 +1602,62 @@ AC_ARG_WITH([audit],
         esac ]
 )
 
+AC_ARG_WITH([pie],
+    [  --with-pie           Build Position Independent Executables if possible], [
+        if test "x$withval" = "xno"; then
+                use_pie=no
+        fi
+        if test "x$withval" = "xyes"; then
+                use_pie=yes
+        fi
+    ]
+)
+if test "x$use_pie" = "x"; then
+        use_pie=no
+fi
+if test "x$use_toolchain_hardening" != "x1" && test "x$use_pie" = "xauto"; then
+        # Turn off automatic PIE when toolchain hardening is off.
+        use_pie=no
+fi
+if test "x$use_pie" = "xauto"; then
+        # Automatic PIE requires gcc >= 4.x
+        AC_MSG_CHECKING([for gcc >= 4.x])
+        AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
+#if !defined(__GNUC__) || __GNUC__ < 4
+#error gcc is too old
+#endif
+]])],
+        [ AC_MSG_RESULT([yes]) ],
+        [ AC_MSG_RESULT([no])
+          use_pie=no ]
+)
+fi
+if test "x$use_pie" != "xno"; then
+        SAVED_CFLAGS="$CFLAGS"
+        SAVED_LDFLAGS="$LDFLAGS"
+        OSSH_CHECK_CFLAG_COMPILE([-fPIE])
+        OSSH_CHECK_LDFLAG_LINK([-pie])
+        # We use both -fPIE and -pie or neither.
+        AC_MSG_CHECKING([whether both -fPIE and -pie are supported])
+        if echo "x $CFLAGS"  | grep ' -fPIE' >/dev/null 2>&1 && \
+           echo "x $LDFLAGS" | grep ' -pie'  >/dev/null 2>&1 ; then
+                AC_MSG_RESULT([yes])
+        else
+                AC_MSG_RESULT([no])
+                CFLAGS="$SAVED_CFLAGS"
+                LDFLAGS="$SAVED_LDFLAGS"
+        fi
+fi
+
 dnl    Checks for library functions. Please keep in alphabetical order
 AC_CHECK_FUNCS([ \
+        Blowfish_initstate \
+        Blowfish_expandstate \
+        Blowfish_expand0state \
+        Blowfish_stream2word \
         arc4random \
         arc4random_buf \
+        arc4random_stir \
         arc4random_uniform \
         asprintf \
         b64_ntop \
@@ -1559,7 +1665,10 @@ AC_CHECK_FUNCS([ \
         b64_pton \
         __b64_pton \
         bcopy \
+        bcrypt_pbkdf \
         bindresvport_sa \
+        blf_enc \
+        cap_rights_limit \
         clock \
         closefrom \
         dirfd \
@@ -1567,6 +1676,7 @@ AC_CHECK_FUNCS([ \
         fchmod \
         fchown \
         freeaddrinfo \
+        fstatfs \
         fstatvfs \
         futimes \
         getaddrinfo \
@@ -2336,7 +2446,17 @@ AC_LINK_IFELSE(
         ]
 )
 
-AC_CHECK_FUNCS([RSA_generate_key_ex DSA_generate_parameters_ex BN_is_prime_ex RSA_get_default_method HMAC_CTX_init])
+AC_CHECK_FUNCS([ \
+        BN_is_prime_ex \
+        DSA_generate_parameters_ex \
+        EVP_DigestInit_ex \
+        EVP_DigestFinal_ex \
+        EVP_MD_CTX_init \
+        EVP_MD_CTX_cleanup \
+        HMAC_CTX_init \
+        RSA_generate_key_ex \
+        RSA_get_default_method \
+])
 
 AC_ARG_WITH([ssl-engine],
         [  --with-ssl-engine       Enable OpenSSL (hardware) ENGINE support ],
@@ -2460,19 +2580,58 @@ fi
 AC_CHECK_FUNCS([crypt DES_crypt])
 
 # Search for SHA256 support in libc and/or OpenSSL
-AC_CHECK_FUNCS([SHA256_Update EVP_sha256],
-    [TEST_SSH_SHA256=yes],
-    [TEST_SSH_SHA256=no
-     unsupported_algorithms="$unsupported_algorithms \
+AC_CHECK_FUNCS([SHA256_Update EVP_sha256], ,
+    [unsupported_algorithms="$unsupported_algorithms \
         hmac-sha2-256 hmac-sha2-512 \
         diffie-hellman-group-exchange-sha256 \
         hmac-sha2-256-etm@openssh.com hmac-sha2-512-etm@openssh.com"
      ]
 )
-AC_SUBST([TEST_SSH_SHA256])
 
 # Check complete ECC support in OpenSSL
-AC_MSG_CHECKING([whether OpenSSL has complete ECC support])
+AC_MSG_CHECKING([whether OpenSSL has NID_X9_62_prime256v1])
+AC_LINK_IFELSE(
+        [AC_LANG_PROGRAM([[
+#include <openssl/ec.h>
+#include <openssl/ecdh.h>
+#include <openssl/ecdsa.h>
+#include <openssl/evp.h>
+#include <openssl/objects.h>
+#include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
+# error "OpenSSL < 0.9.8g has unreliable ECC code"
+#endif
+        ]], [[
+        EC_KEY *e = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+        const EVP_MD *m = EVP_sha256(); /* We need this too */
+        ]])],
+        [ AC_MSG_RESULT([yes])
+          enable_nistp256=1 ],
+        [ AC_MSG_RESULT([no]) ]
+)
+
+AC_MSG_CHECKING([whether OpenSSL has NID_secp384r1])
+AC_LINK_IFELSE(
+        [AC_LANG_PROGRAM([[
+#include <openssl/ec.h>
+#include <openssl/ecdh.h>
+#include <openssl/ecdsa.h>
+#include <openssl/evp.h>
+#include <openssl/objects.h>
+#include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER < 0x0090807f /* 0.9.8g */
+# error "OpenSSL < 0.9.8g has unreliable ECC code"
+#endif
+        ]], [[
+        EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp384r1);
+        const EVP_MD *m = EVP_sha384(); /* We need this too */
+        ]])],
+        [ AC_MSG_RESULT([yes])
+          enable_nistp384=1 ],
+        [ AC_MSG_RESULT([no]) ]
+)
+
+AC_MSG_CHECKING([whether OpenSSL has NID_secp521r1])
 AC_LINK_IFELSE(
         [AC_LANG_PROGRAM([[
 #include <openssl/ec.h>
@@ -2488,25 +2647,63 @@ AC_LINK_IFELSE(
         EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
         const EVP_MD *m = EVP_sha512(); /* We need this too */
         ]])],
-        [
-                AC_MSG_RESULT([yes])
-                AC_DEFINE([OPENSSL_HAS_ECC], [1],
-                    [libcrypto includes complete ECC support])
-                TEST_SSH_ECC=yes
-                COMMENT_OUT_ECC=""
-        ],
-        [
-                AC_MSG_RESULT([no])
-                TEST_SSH_ECC=no
-                COMMENT_OUT_ECC="#no ecc#"
-                unsupported_algorithms="$unsupported_algorithms \
-                    ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 \
-                    ecdsa-sha2-nistp256-cert-v01@openssh.com \
-                    ecdsa-sha2-nistp384-cert-v01@openssh.com \
-                    ecdsa-sha2-nistp521-cert-v01@openssh.com \
-                    ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521"
-        ]
+        [ AC_MSG_RESULT([yes])
+          AC_MSG_CHECKING([if OpenSSL's NID_secp521r1 is functional])
+          AC_RUN_IFELSE(
+                [AC_LANG_PROGRAM([[
+#include <openssl/ec.h>
+#include <openssl/ecdh.h>
+#include <openssl/ecdsa.h>
+#include <openssl/evp.h>
+#include <openssl/objects.h>
+#include <openssl/opensslv.h>
+                ]],[[
+                EC_KEY *e = EC_KEY_new_by_curve_name(NID_secp521r1);
+                const EVP_MD *m = EVP_sha512(); /* We need this too */
+                exit(e == NULL || m == NULL);
+                ]])],
+                [ AC_MSG_RESULT([yes])
+                  enable_nistp521=1 ],
+                [ AC_MSG_RESULT([no]) ],
+                [ AC_MSG_WARN([cross-compiling: assuming yes])
+                  enable_nistp521=1 ]
+          )],
+        AC_MSG_RESULT([no])
 )
+
+COMMENT_OUT_ECC="#no ecc#"
+TEST_SSH_ECC=no
+
+if test x$enable_nistp256 = x1 || test x$enable_nistp384 = x1 || \
+    test x$enable_nistp521 = x1; then
+        AC_DEFINE(OPENSSL_HAS_ECC, [1], [OpenSSL has ECC])
+fi
+if test x$enable_nistp256 = x1; then
+        AC_DEFINE([OPENSSL_HAS_NISTP256], [1],
+            [libcrypto has NID_X9_62_prime256v1])
+        TEST_SSH_ECC=yes
+        COMMENT_OUT_ECC=""
+else
+        unsupported_algorithms="$unsupported_algorithms ecdsa-sha2-nistp256 \
+            ecdh-sha2-nistp256 ecdsa-sha2-nistp256-cert-v01@openssh.com"
+fi
+if test x$enable_nistp384 = x1; then
+        AC_DEFINE([OPENSSL_HAS_NISTP384], [1], [libcrypto has NID_secp384r1])
+        TEST_SSH_ECC=yes
+        COMMENT_OUT_ECC=""
+else
+        unsupported_algorithms="$unsupported_algorithms ecdsa-sha2-nistp384 \
+            ecdh-sha2-nistp384 ecdsa-sha2-nistp384-cert-v01@openssh.com"
+fi
+if test x$enable_nistp521 = x1; then
+        AC_DEFINE([OPENSSL_HAS_NISTP521], [1], [libcrypto has NID_secp521r1])
+        TEST_SSH_ECC=yes
+        COMMENT_OUT_ECC=""
+else
+        unsupported_algorithms="$unsupported_algorithms ecdh-sha2-nistp521 \
+            ecdsa-sha2-nistp521 ecdsa-sha2-nistp521-cert-v01@openssh.com"
+fi
+
 AC_SUBST([TEST_SSH_ECC])
 AC_SUBST([COMMENT_OUT_ECC])
 
@@ -2738,7 +2935,7 @@ fi
 # Decide which sandbox style to use
 sandbox_arg=""
 AC_ARG_WITH([sandbox],
-        [  --with-sandbox=style    Specify privilege separation sandbox (no, darwin, rlimit, systrace, seccomp_filter)],
+        [  --with-sandbox=style    Specify privilege separation sandbox (no, darwin, rlimit, systrace, seccomp_filter, capsicum)],
         [
                 if test "x$withval" = "xyes" ; then
                         sandbox_arg=""
@@ -2867,6 +3064,16 @@ elif test "x$sandbox_arg" = "xseccomp_filter" || \
                 AC_MSG_ERROR([seccomp_filter sandbox requires prctl function])
         SANDBOX_STYLE="seccomp_filter"
         AC_DEFINE([SANDBOX_SECCOMP_FILTER], [1], [Sandbox using seccomp filter])
+elif test "x$sandbox_arg" = "xcapsicum" || \
+     ( test -z "$sandbox_arg" && \
+       test "x$ac_cv_header_sys_capability_h" = "xyes" && \
+       test "x$ac_cv_func_cap_rights_limit" = "xyes") ; then
+       test "x$ac_cv_header_sys_capability_h" != "xyes" && \
+                AC_MSG_ERROR([capsicum sandbox requires sys/capability.h header])
+       test "x$ac_cv_func_cap_rights_limit" != "xyes" && \
+                AC_MSG_ERROR([capsicum sandbox requires cap_rights_limit function])
+       SANDBOX_STYLE="capsicum"
+       AC_DEFINE([SANDBOX_CAPSICUM], [1], [Sandbox using capsicum])
 elif test "x$sandbox_arg" = "xrlimit" || \
      ( test -z "$sandbox_arg" && test "x$ac_cv_func_setrlimit" = "xyes" && \
        test "x$select_works_with_rlimit" = "xyes" && \
@@ -3090,7 +3297,9 @@ if test "x$ac_cv_have_u_int64_t" = "xyes" ; then
         have_u_int64_t=1
 fi
 
-if test -z "$have_u_int64_t" ; then
+if (test -z "$have_u_int64_t" && \
+           test "x$ac_cv_header_sys_bitypes_h" = "xyes")
+then
     AC_MSG_CHECKING([for u_int64_t type in sys/bitypes.h])
         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <sys/bitypes.h> ]],
         [[ u_int64_t a; a = 1]])],
@@ -3120,7 +3329,9 @@ if test -z "$have_u_intxx_t" ; then
         fi
 fi
 
-if test -z "$have_uintxx_t" ; then
+if (test -z "$have_uintxx_t" && \
+           test "x$ac_cv_header_stdint_h" = "xyes")
+then
     AC_MSG_CHECKING([for uintXX_t types in stdint.h])
         AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdint.h> ]],
         [[ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;]])],
@@ -3131,6 +3342,19 @@ if test -z "$have_uintxx_t" ; then
         ])
 fi
 
+if (test -z "$have_uintxx_t" && \
+           test "x$ac_cv_header_inttypes_h" = "xyes")
+then
+    AC_MSG_CHECKING([for uintXX_t types in inttypes.h])
+        AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <inttypes.h> ]],
+        [[ uint8_t a; uint16_t b; uint32_t c; a = b = c = 1;]])],
+                [
+                        AC_DEFINE([HAVE_UINTXX_T])
+                        AC_MSG_RESULT([yes])
+                ], [ AC_MSG_RESULT([no]) 
+        ])
+fi
+
 if (test -z "$have_u_intxx_t" || test -z "$have_intxx_t" && \
            test "x$ac_cv_header_sys_bitypes_h" = "xyes")
 then
@@ -3161,6 +3385,11 @@ if test "x$ac_cv_have_u_char" = "xyes" ; then
         AC_DEFINE([HAVE_U_CHAR], [1], [define if you have u_char data type])
 fi
 
+AC_CHECK_TYPES([intmax_t, uintmax_t], , , [
+#include <sys/types.h>
+#include <stdint.h>
+])
+
 TYPE_SOCKLEN_T
 
 AC_CHECK_TYPES([sig_atomic_t], , , [#include <signal.h>])
@@ -4609,6 +4838,7 @@ else
 fi
 AC_CHECK_DECL([BROKEN_GETADDRINFO],  [TEST_SSH_IPV6=no])
 AC_SUBST([TEST_SSH_IPV6], [$TEST_SSH_IPV6])
+AC_SUBST([TEST_MALLOC_OPTIONS], [$TEST_MALLOC_OPTIONS])
 AC_SUBST([UNSUPPORTED_ALGORITHMS], [$unsupported_algorithms])
 
 AC_EXEEXT