summaryrefslogtreecommitdiff
path: root/configure.ac
Commit message (Collapse)AuthorAgeFilesLines
* put back SSLeay_version compat in configure testDamien Miller2023-03-241-1/+10
| | | | | Needed to detect old versions and give good "your version is bad" messages at configure time; spotted by dtucker@
* remove support for old libcryptoDamien Miller2023-03-241-66/+30
| | | | | | | OpenSSH now requires LibreSSL 3.1.0 or greater or OpenSSL 1.1.1 or greater with/ok dtucker@
* fix libfido2 detection without pkg-configDamien Miller2023-02-011-1/+1
| | | | | Place libfido2 before additional libraries (that it may depend upon) and not after. bz3530 from James Zhang; ok dtucker@
* Use autoconf to find openssl binary.Darren Tucker2023-01-071-5/+3
| | | | | | | It's possible to install an OpenSSL in a path not in the system's default library search path. OpenSSH can still use this (eg if you specify an rpath) but the openssl binary there may not work. If one is available on the system path just use that.
* Check openssl_bin path is executable before using.Darren Tucker2023-01-071-3/+5
|
* Set OPENSSL_BIN from OpenSSL directory.Darren Tucker2023-01-061-0/+6
|
* Fix typo in comment. Spotted by tim@Darren Tucker2022-12-061-1/+1
|
* Use -fzero-call-used-regs=used on clang 15.Darren Tucker2022-11-301-12/+23
| | | | | | | | | | | clang 15 seems to have a problem with -fzero-call-used-reg=all which causes spurious "incorrect signature" failures with ED25519. On those versions, use -fzero-call-used-regs=used instead. (We may add exceptions later if specific versions prove to be OK). Also move the GCC version check to match. Initial investigation by Daniel Pouzzner (douzzer at mega nu), workaround suggested by Bill Wendling (morbo at google com). bz#3475, ok djm@
* If we haven't found it yet, recheck for sys/stat.h.Darren Tucker2022-11-231-1/+8
| | | | | | | | On some very old platforms, sys/stat.h needs sys/types.h, however autoconf 2.71's AC_CHECK_INCLUDES_DEFAULT checks for them in the opposite order, which in combination with modern autoconf's "present but cannot be compiled" behaviour causes it to not be detected.
* Fix setres*id checks to work with clang-16.Darren Tucker2022-11-071-3/+6
| | | | | | | glibc has the prototypes for setresuid and setresgid behind _GNU_SOURCE, and clang 16 will error out on implicit function definitions, so add _GNU_SOURCE and the required headers to the configure checks. From sam at @gentoo.org via bz#3497.
* configure.ac: Fix -Wstrict-prototypesSam James2022-11-061-4/+4
| | | | | | | | Clang 16 now warns on this and it'll be removed in C23, so let's just be future proof. It also reduces noise when doing general Clang 16 porting work (which is a big job as it is). github PR#355. Signed-off-by: Sam James <sam@gentoo.org>
* configure.ac: Add <pty.h> include for openptySam James2022-11-061-0/+3
| | | | | | | | Another Clang 16ish fix (which makes -Wimplicit-function-declaration an error by default). github PR#355. See: 2efd71da49b9cfeab7987058cf5919e473ff466b See: be197635329feb839865fdc738e34e24afd1fca8
* Check for sockaddr_in.sin_len.Darren Tucker2022-11-021-0/+10
| | | | | If found, set SOCK_HAS_LEN which is used in addr.c. Should fix keyscan tests on platforms with this (eg old NetBSD).
* OpenSSL dev branch is 302 not 320.Darren Tucker2022-10-311-1/+1
| | | | While there, also accept 301 which it shat it was previously.
* OpenSSL dev branch now identifies as 3.2.0.Darren Tucker2022-10-181-1/+1
|
* Fix snprintf configure test for clang 15Harmen Stoppels2022-10-141-3/+3
| | | | | | Clang 15 -Wimplicit-int defaults to an error in C99 mode and above. A handful of tests have "main(..." and not "int main(..." which caused the tests to produce incorrect results.
* Add a timegm implementation from Heimdal via Samba.Darren Tucker2022-08-111-0/+1
| | | | Fixes build on (at least Solaris 10).
* compat code for fido_dev_is_winhello()Corinna Vinschen2022-08-051-0/+1
| | | | Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
* Factor out getrnd() and rename to getentropy().Darren Tucker2022-08-051-1/+2
| | | | | | | Factor out the arc4random seeding into its own file and change the interface to match getentropy. Use native getentropy if available. This will make it easier to resync OpenBSD changes to arc4random. Prompted by bz#3467, ok djm@.
* Include CHANNEL and FIDO2 libs in configure outputDarren Tucker2022-08-041-0/+6
|
* Move stale-configure check as early as possible.Darren Tucker2022-07-271-0/+8
| | | | | | | We added a check in Makefile to catch the case where configure needs to be rebuilt, however this did not happen until a build was attempted in which case all of the work done by configure was wasted. Move this check to the start of configure to catch it as early as possible. ok djm@
* Move libcrypto into CHANNELLIBS.Darren Tucker2022-07-271-3/+4
| | | | | This will result in sftp, sftp-server and scp no longer being linked against libcrypto. ok djm@
* Group libcrypto and PRNGD checks together.Darren Tucker2022-07-271-20/+20
| | | | | They're related more than the libcrypt or libiaf checks which are currently between them. ok djm@
* Do not link scp, sftp and sftp-server w/ zlib.Darren Tucker2022-07-271-5/+9
| | | | | | | | Some of our binaries (eg sftp, sftp-server, scp) do not interact with the channels code and thus do use libraries such as zlib and libcrypto although they are linked with them. This adds a CHANNELLIBS and starts by moving zlib into it, which means the aformentioned binaries are no longer linked against zlib. ok djm@
* Remove workarounds for OpenSSL missing AES-CTR.Darren Tucker2022-07-251-22/+0
| | | | | | | We have some compatibility hacks that were added to support OpenSSL versions that do not support AES CTR mode. Since that time, however, the minimum OpenSSL version that we support has moved to 1.0.1 which *does* have CTR, so this is no longer needed. ok djm@
* Remove workarounds for OpenSSL missing AES-GCM.Darren Tucker2022-07-251-30/+0
| | | | | | | We have some compatibility hacks that were added to support OpenSSL versions that do not support AES GCM mode. Since that time, however, the minimum OpenSSL version that we support has moved to 1.0.1 which *does* have GCM, so this is no longer needed. ok djm@
* Add AUDIT_ARCH_PPC to supported seccomp arches.Darren Tucker2022-07-151-0/+3
| | | | Patch from dries.deschout at dodeco.eu.
* Remove special casing of crypt().Darren Tucker2022-07-131-24/+11
| | | | | | | | | | | Configure goes to some lengths to pick crypt() from either libcrypt or OpenSSL's libcrypto because they can more or less featureful (eg supporting md5-style passwords). OpenSSL removed its crypt() interface in 2002: https://github.com/openssl/openssl/commit/69deec58 so these hijinks should no longer be necessary. This also only links sshd with libcrypt which is the only thing that needs it. ok djm@
* Only refuse to use OpenSSL 3.0.4 on x86_64.Darren Tucker2022-07-131-1/+9
| | | | | The potential RCE only impacts x86_64, so only refuse to use it if we're targetting a potentially impacted architecture. ok djm@
* Refuse to use OpenSSL 3.0.4 due to potential RCE.Darren Tucker2022-07-121-0/+1
| | | | | OpenSSL has a potential RCE in its RSA implementation (CVE-2022-2274) so refuse to use that specific version.
* Skip all rlimit tests when sandboxing disabled.Darren Tucker2022-07-031-11/+9
| | | | | The rlimit tests can hang when being run with some compiler sanitizers so skip all of them if sandbox=no.
* Move checks for pollfd.fd and nfds_t.Darren Tucker2022-07-031-20/+20
| | | | | | Move the checks for struct pollfd.fd and nfds_t to before the sandboxing checks. This groups all the sandbox checks together so we can skip them all when sandboxing is disabled.
* Skip select+rlimit check if sandboxing is disabledDarren Tucker2022-07-011-4/+8
| | | | | It's not needed in that case, and the test can fail when being built with some compiler memory sanitizer flags. bz#3441
* Zero out LIBFIDO2 when SK support not usable.Darren Tucker2022-06-251-1/+1
| | | | | Prevents us from trying to link them into ssh-sk-helper and failing to build.
* Disable SK support if FIDO libs not found.Darren Tucker2022-06-251-0/+1
|
* fix broken case statement in previousDamien Miller2022-06-241-0/+1
|
* request 1.1x API compatibility for OpenSSL >=3.xDamien Miller2022-06-241-2/+7
| | | | idea/patch from Pedro Martelletto via GHPR#322; ok dtucker@
* automatically enable built-in FIDO supportDamien Miller2022-06-241-31/+34
| | | | | | | | If libfido2 is found and usable, then enable the built-in security key support unless --without-security-key-builtin was requested. ok dtucker@
* configure.ac: Add missing AC_DEFINE for caph_cache_tzdata test causingTim Rice2022-05-241-1/+5
| | | | | HAVE_CAPH_CACHE_TZDATA to be missing from config.h.in. Spotted by Bryan Drewery
* Cache timezone data in capsicum sandbox.Darren Tucker2022-04-231-1/+9
| | | | | From emaste at freebsd.org, originally part of FreeBSD commit r339216 / fc3c19a9 with autoconf bits added by me.
* Use bash or ksh if available for SH in Makefile.Darren Tucker2022-04-011-0/+2
|
* Provide killpg implementation.Darren Tucker2022-03-091-0/+1
| | | | Based on github PR#301 for Tandem NonStop.
* Check for missing ftruncate prototype.Darren Tucker2022-03-091-0/+6
| | | | From github PR#301 in conjunction with rsbeckerca.
* Default to not using sandbox when cross compiling.Darren Tucker2022-03-081-2/+2
| | | | | | On most systems poll(2) does not work when the number of FDs is reduced with setrlimit, so assume it doesn't when cross compiling and we can't run the test. bz#3398.
* Extend select+rlimit sanbox test to include poll.Darren Tucker2022-02-221-5/+23
| | | | | | | | | | POSIX specifies that poll() shall fail if "nfds argument is greater than {OPEN_MAX}". The setrlimit sandbox sets this to effectively zero so this causes poll() to fail in the preauth privsep process. This is likely the underlying cause for the previously observed similar behaviour of select() on plaforms where it is implement in userspace on top of poll().
* Include sys/param.h if present.Darren Tucker2022-02-221-0/+1
| | | | Needed for howmany() on MUSL systems such as Alpine.
* minix needs BROKEN_POLL too; chokes on /dev/nullDamien Miller2022-02-171-0/+3
|
* Simplify handling of --with-ssl-dir.Darren Tucker2022-02-111-15/+9
| | | | ok djm@
* compat code for fido_assert_set_clientdata()Damien Miller2022-02-071-0/+1
|
* upstream: use libfido2 1.8.0+ fido_assert_set_clientdata() insteaddjm@openbsd.org2022-02-071-0/+1
| | | | | | | of manually hashing data outselves. Saves a fair bit of code and makes life easier for some -portable platforms. OpenBSD-Commit-ID: 351dfaaa5ab1ee928c0e623041fca28078cff0e0
View Lorry Controller Status