summaryrefslogtreecommitdiffstats
path: root/configure.ac
AgeCommit message (Collapse)Author
2024-03-07Prefer openssl binary from --with-ssl-dir directory.Darren Tucker
Use openssl in the directory specified by --with-ssl-dir as long as it's functional. Reported by The Doctor.
2024-03-06add a --without-retpoline configure optionDamien Miller
discussed with deraadt and dtucker a while ago
2024-02-22more descriptive configure test nameDamien Miller
2024-02-19Improve error message for OpenSSL header check.Darren Tucker
bz#3668, ok djm@
2024-02-06Add --disable-fd-passing option.Darren Tucker
.. and enable for the minix3 test VM. This will cause it to more reliably skip tests that need FD passing and should fix the current test breakage.
2024-01-11upstream: make DSA key support compile-time optional, defaulting todjm@openbsd.org
on ok markus@ OpenBSD-Commit-ID: 4f8e98fc1fd6de399d0921d5b31b3127a03f581d
2023-12-18better detection of broken -fzero-call-used-regsDamien Miller
Use OSSH_CHECK_CFLAG_LINK() for detection of these flags and extend test program to exercise varargs, which seems to catch more stuff. ok dtucker@
2023-11-21Stop using -fzero-call-used-regs=allDarren Tucker
... since it seems to be problematic with several different versions of clang. Only use -fzero-call-used-regs=used which is less problematic, except with Apple's clang where we don't use it at all. bz#3629, ok djm@
2023-11-21Allow for vendor prefix on clang version numbers.Darren Tucker
Correctly detects the version of OpenBSD's native clang, as well as Apple's. Spotted tb@, ok djm@.
2023-10-30Add OpenSSL 3.3.0 as a known dev version.Darren Tucker
2023-10-20Have configure find PuTTY and Conch binaries.Darren Tucker
This will let us remove some -portable specific changes from test-exec.sh.
2023-10-20upstream: Allow overriding the locations of the Dropbear binariesdtucker@openbsd.org
similar to what we do for the PuTTY ones. OpenBSD-Regress-ID: 7de0e00518fb0c8fdc5f243b7f82f523c936049c
2023-10-12Correct arg order for ED255519 AC_LINK_IFELSE test.Darren Tucker
2023-10-12upstream: add support for reading ED25519 private keys in PEM PKCS8djm@openbsd.org
format; ok markus@ tb@ OpenBSD-Commit-ID: 01b85c91757e6b057e9b23b8a23f96415c3c7174
2023-09-10Use zero-call-used-regs=used with Apple compilers.Darren Tucker
Apple's versions of clang have version numbers that do not match the corresponding upstream clang versions. Unfortunately, they do still have the clang-15 zero-call-used-regs=all bug, so for now use the value that doesn't result in segfaults. We could allowlist future versions that are known to work. bz#3584 (and probably also our github CI failures).
2023-08-19Fix zlib version check for 1.3 and future version.Darren Tucker
bz#3604.
2023-03-24put back SSLeay_version compat in configure testDamien Miller
Needed to detect old versions and give good "your version is bad" messages at configure time; spotted by dtucker@
2023-03-24remove support for old libcryptoDamien Miller
OpenSSH now requires LibreSSL 3.1.0 or greater or OpenSSL 1.1.1 or greater with/ok dtucker@
2023-02-01fix libfido2 detection without pkg-configDamien Miller
Place libfido2 before additional libraries (that it may depend upon) and not after. bz3530 from James Zhang; ok dtucker@
2023-01-07Use autoconf to find openssl binary.Darren Tucker
It's possible to install an OpenSSL in a path not in the system's default library search path. OpenSSH can still use this (eg if you specify an rpath) but the openssl binary there may not work. If one is available on the system path just use that.
2023-01-07Check openssl_bin path is executable before using.Darren Tucker
2023-01-06Set OPENSSL_BIN from OpenSSL directory.Darren Tucker
2022-12-06Fix typo in comment. Spotted by tim@Darren Tucker
2022-11-30Use -fzero-call-used-regs=used on clang 15.Darren Tucker
clang 15 seems to have a problem with -fzero-call-used-reg=all which causes spurious "incorrect signature" failures with ED25519. On those versions, use -fzero-call-used-regs=used instead. (We may add exceptions later if specific versions prove to be OK). Also move the GCC version check to match. Initial investigation by Daniel Pouzzner (douzzer at mega nu), workaround suggested by Bill Wendling (morbo at google com). bz#3475, ok djm@
2022-11-23If we haven't found it yet, recheck for sys/stat.h.Darren Tucker
On some very old platforms, sys/stat.h needs sys/types.h, however autoconf 2.71's AC_CHECK_INCLUDES_DEFAULT checks for them in the opposite order, which in combination with modern autoconf's "present but cannot be compiled" behaviour causes it to not be detected.
2022-11-07Fix setres*id checks to work with clang-16.Darren Tucker
glibc has the prototypes for setresuid and setresgid behind _GNU_SOURCE, and clang 16 will error out on implicit function definitions, so add _GNU_SOURCE and the required headers to the configure checks. From sam at @gentoo.org via bz#3497.
2022-11-06configure.ac: Fix -Wstrict-prototypesSam James
Clang 16 now warns on this and it'll be removed in C23, so let's just be future proof. It also reduces noise when doing general Clang 16 porting work (which is a big job as it is). github PR#355. Signed-off-by: Sam James <sam@gentoo.org>
2022-11-06configure.ac: Add <pty.h> include for openptySam James
Another Clang 16ish fix (which makes -Wimplicit-function-declaration an error by default). github PR#355. See: 2efd71da49b9cfeab7987058cf5919e473ff466b See: be197635329feb839865fdc738e34e24afd1fca8
2022-11-02Check for sockaddr_in.sin_len.Darren Tucker
If found, set SOCK_HAS_LEN which is used in addr.c. Should fix keyscan tests on platforms with this (eg old NetBSD).
2022-10-31OpenSSL dev branch is 302 not 320.Darren Tucker
While there, also accept 301 which it shat it was previously.
2022-10-18OpenSSL dev branch now identifies as 3.2.0.Darren Tucker
2022-10-14Fix snprintf configure test for clang 15Harmen Stoppels
Clang 15 -Wimplicit-int defaults to an error in C99 mode and above. A handful of tests have "main(..." and not "int main(..." which caused the tests to produce incorrect results.
2022-08-11Add a timegm implementation from Heimdal via Samba.Darren Tucker
Fixes build on (at least Solaris 10).
2022-08-05compat code for fido_dev_is_winhello()Corinna Vinschen
Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
2022-08-05Factor out getrnd() and rename to getentropy().Darren Tucker
Factor out the arc4random seeding into its own file and change the interface to match getentropy. Use native getentropy if available. This will make it easier to resync OpenBSD changes to arc4random. Prompted by bz#3467, ok djm@.
2022-08-04Include CHANNEL and FIDO2 libs in configure outputDarren Tucker
2022-07-27Move stale-configure check as early as possible.Darren Tucker
We added a check in Makefile to catch the case where configure needs to be rebuilt, however this did not happen until a build was attempted in which case all of the work done by configure was wasted. Move this check to the start of configure to catch it as early as possible. ok djm@
2022-07-27Move libcrypto into CHANNELLIBS.Darren Tucker
This will result in sftp, sftp-server and scp no longer being linked against libcrypto. ok djm@
2022-07-27Group libcrypto and PRNGD checks together.Darren Tucker
They're related more than the libcrypt or libiaf checks which are currently between them. ok djm@
2022-07-27Do not link scp, sftp and sftp-server w/ zlib.Darren Tucker
Some of our binaries (eg sftp, sftp-server, scp) do not interact with the channels code and thus do use libraries such as zlib and libcrypto although they are linked with them. This adds a CHANNELLIBS and starts by moving zlib into it, which means the aformentioned binaries are no longer linked against zlib. ok djm@
2022-07-25Remove workarounds for OpenSSL missing AES-CTR.Darren Tucker
We have some compatibility hacks that were added to support OpenSSL versions that do not support AES CTR mode. Since that time, however, the minimum OpenSSL version that we support has moved to 1.0.1 which *does* have CTR, so this is no longer needed. ok djm@
2022-07-25Remove workarounds for OpenSSL missing AES-GCM.Darren Tucker
We have some compatibility hacks that were added to support OpenSSL versions that do not support AES GCM mode. Since that time, however, the minimum OpenSSL version that we support has moved to 1.0.1 which *does* have GCM, so this is no longer needed. ok djm@
2022-07-15Add AUDIT_ARCH_PPC to supported seccomp arches.Darren Tucker
Patch from dries.deschout at dodeco.eu.
2022-07-13Remove special casing of crypt().Darren Tucker
Configure goes to some lengths to pick crypt() from either libcrypt or OpenSSL's libcrypto because they can more or less featureful (eg supporting md5-style passwords). OpenSSL removed its crypt() interface in 2002: https://github.com/openssl/openssl/commit/69deec58 so these hijinks should no longer be necessary. This also only links sshd with libcrypt which is the only thing that needs it. ok djm@
2022-07-13Only refuse to use OpenSSL 3.0.4 on x86_64.Darren Tucker
The potential RCE only impacts x86_64, so only refuse to use it if we're targetting a potentially impacted architecture. ok djm@
2022-07-12Refuse to use OpenSSL 3.0.4 due to potential RCE.Darren Tucker
OpenSSL has a potential RCE in its RSA implementation (CVE-2022-2274) so refuse to use that specific version.
2022-07-03Skip all rlimit tests when sandboxing disabled.Darren Tucker
The rlimit tests can hang when being run with some compiler sanitizers so skip all of them if sandbox=no.
2022-07-03Move checks for pollfd.fd and nfds_t.Darren Tucker
Move the checks for struct pollfd.fd and nfds_t to before the sandboxing checks. This groups all the sandbox checks together so we can skip them all when sandboxing is disabled.
2022-07-01Skip select+rlimit check if sandboxing is disabledDarren Tucker
It's not needed in that case, and the test can fail when being built with some compiler memory sanitizer flags. bz#3441
2022-06-25Zero out LIBFIDO2 when SK support not usable.Darren Tucker
Prevents us from trying to link them into ssh-sk-helper and failing to build.
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-26 01:42:59 +0000