1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
|
AC_DEFUN([DOVECOT_SSL], [
have_ssl=no
build_dcrypt_openssl=no
if test $want_openssl != no && test $have_ssl = no; then
if test "$PKG_CONFIG" != "" && $PKG_CONFIG --exists openssl 2>/dev/null; then
PKG_CHECK_MODULES(SSL, openssl)
CFLAGS="$CFLAGS $SSL_CFLAGS"
have_openssl=yes
else
# openssl 0.9.8 wants -ldl and it's required if there's only .a lib
AC_CHECK_LIB(ssl, SSL_read, [
AC_CHECK_HEADERS(openssl/ssl.h openssl/err.h, [
SSL_LIBS="-lssl -lcrypto $DLLIB"
AC_SUBST(SSL_LIBS)
have_openssl=yes
], [
if test $want_openssl = yes; then
AC_ERROR([Can't build with OpenSSL: openssl/ssl.h or openssl/err.h not found])
fi
])
], [
if test $want_openssl = yes; then
AC_ERROR([Can't build with OpenSSL: libssl not found])
fi
], -lcrypto $DLLIB)
fi
if test "$have_openssl" = "yes"; then
AC_DEFINE(HAVE_OPENSSL,, [Build with OpenSSL support])
have_ssl="yes (OpenSSL)"
AC_MSG_CHECKING([if OpenSSL version is 1.0.1 or newer])
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
#include <openssl/opensslv.h>
#if OPENSSL_VERSION_NUMBER < 0x10001000L
#error "fail-compile"
#endif]], [[ return 0; ]])],
[ssl_version_ge_101=true], [ssl_version_ge_101=false])
AC_MSG_RESULT([$ssl_version_ge_101])
if test $ssl_version_ge_101 = false; then
AC_MSG_ERROR([Found deprecated OpenSSL version, use 1.0.1 or newer])
fi
AC_MSG_CHECKING([if OpenSSL version is 1.0.2 or better])
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
#include <openssl/opensslv.h>
#if OPENSSL_VERSION_NUMBER < 0x10002000L
#error "fail-compile"
#endif]], [[ return 0; ]])], [ssl_version_ge_102=true], [ssl_version_ge_102=false])
AC_MSG_RESULT([$ssl_version_ge_102])
# SSL_clear_options introduced in openssl 0.9.8m but may be backported to
# older versions in "enterprise" OS releases; originally implemented as a
# macro but as a function in more recent openssl versions
AC_CACHE_CHECK([whether SSL_clear_options exists],i_cv_have_ssl_clear_options,[
old_LIBS=$LIBS
LIBS="$LIBS -lssl"
AC_TRY_LINK([
#include <openssl/ssl.h>
], [
SSL *ssl;
long options;
SSL_clear_options(ssl, options);
], [
i_cv_have_ssl_clear_options=yes
], [
i_cv_have_ssl_clear_options=no
])
LIBS=$old_LIBS
])
if test $i_cv_have_ssl_clear_options = yes; then
AC_DEFINE(HAVE_SSL_CLEAR_OPTIONS,, [Define if you have SSL_clear_options])
fi
# New style mem functions? Should be in v1.1+
AC_CACHE_CHECK([whether CRYPTO_set_mem_functions has new style parameters],i_cv_have_ssl_new_mem_funcs,[
old_LIBS=$LIBS
LIBS="$LIBS -lssl"
AC_TRY_LINK([
#include <openssl/ssl.h>
int CRYPTO_set_mem_functions(
void *(*m) (size_t, const char *, int),
void *(*r) (void *, size_t, const char *, int),
void (*f) (void *, const char *, int));
], [
], [
i_cv_have_ssl_new_mem_funcs=yes
], [
i_cv_have_ssl_new_mem_funcs=no
])
LIBS=$old_LIBS
])
if test $i_cv_have_ssl_new_mem_funcs = yes; then
AC_DEFINE(HAVE_SSL_NEW_MEM_FUNCS,, [Define if CRYPTO_set_mem_functions has new style parameters])
fi
# SSL_CTX_set1_curves_list is a macro so plain AC_CHECK_LIB fails here.
AC_CACHE_CHECK([whether SSL_CTX_set1_curves_list exists],i_cv_have_ssl_ctx_set1_curves_list,[
old_LIBS=$LIBS
LIBS="$LIBS -lssl"
AC_TRY_LINK([
#include <openssl/ssl.h>
], [
SSL_CTX_set1_curves_list((void*)0, "");
], [
i_cv_have_ssl_ctx_set1_curves_list=yes
], [
i_cv_have_ssl_ctx_set1_curves_list=no
])
LIBS=$old_LIBS
])
if test $i_cv_have_ssl_ctx_set1_curves_list = yes; then
AC_DEFINE(HAVE_SSL_CTX_SET1_CURVES_LIST,, [Define if you have SSL_CTX_set1_curves_list])
fi
# SSL_CTX_set_min_proto_version is also a macro so AC_CHECK_LIB fails here.
AC_CACHE_CHECK([whether SSL_CTX_set_min_proto_version exists],i_cv_have_ssl_ctx_set_min_proto_version,[
old_LIBS=$LIBS
LIBS="$LIBS -lssl"
AC_TRY_LINK([
#include <openssl/ssl.h>
], [
SSL_CTX_set_min_proto_version((void*)0, 0);
], [
i_cv_have_ssl_ctx_set_min_proto_version=yes
], [
i_cv_have_ssl_ctx_set_min_proto_version=no
])
LIBS=$old_LIBS
])
if test $i_cv_have_ssl_ctx_set_min_proto_version = yes; then
AC_DEFINE(HAVE_SSL_CTX_SET_MIN_PROTO_VERSION,, [Define if you have SSL_CTX_set_min_proto_version])
fi
# SSL_CTX_add0_chain_cert is also a macro so AC_CHECK_LIB fails here.
AC_CACHE_CHECK([whether SSL_CTX_add0_chain_cert exists],i_cv_have_ssl_ctx_add0_chain_cert,[
old_LIBS=$LIBS
LIBS="$LIBS -lssl"
AC_TRY_LINK([
#include <openssl/ssl.h>
], [
SSL_CTX_add0_chain_cert((void*)0, 0);
], [
i_cv_have_ssl_ctx_add0_chain_cert=yes
], [
i_cv_have_ssl_ctx_add0_chain_cert=no
])
LIBS=$old_LIBS
])
if test $i_cv_have_ssl_ctx_add0_chain_cert = yes; then
AC_DEFINE(HAVE_SSL_CTX_ADD0_CHAIN_CERT,, [Define if you have SSL_CTX_add0_chain_cert])
fi
# SSL_CTX_set_current_cert is also a macro so AC_CHECK_LIB fails here.
AC_CACHE_CHECK([whether SSL_CTX_set_current_cert exists],i_cv_have_ssl_ctx_set_current_cert,[
old_LIBS=$LIBS
LIBS="$LIBS -lssl"
AC_TRY_LINK([
#include <openssl/ssl.h>
], [
SSL_CTX_set_current_cert((void*)0, 0);
], [
i_cv_have_ssl_ctx_set_current_cert=yes
], [
i_cv_have_ssl_ctx_set_current_cert=no
])
LIBS=$old_LIBS
])
if test $i_cv_have_ssl_ctx_set_current_cert = yes; then
AC_DEFINE(HAVE_SSL_CTX_SET_CURRENT_CERT,, [Define if you have SSL_CTX_set_current_cert])
fi
AC_CHECK_LIB(ssl, SSL_CIPHER_get_kx_nid, [
AC_DEFINE(HAVE_SSL_CIPHER_get_kx_nid,, [Define if you have SSL_CIPHER_get_kx_nid])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, ERR_remove_thread_state, [
AC_DEFINE(HAVE_OPENSSL_ERR_REMOVE_THREAD_STATE,, [Define if you have ERR_remove_thread_state])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, OPENSSL_thread_stop, [
AC_DEFINE(HAVE_OPENSSL_AUTO_THREAD_DEINIT,, [Define if OpenSSL performs thread cleanup automatically])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, OPENSSL_cleanup, [
AC_DEFINE(HAVE_OPENSSL_CLEANUP,, [OpenSSL supports OPENSSL_cleanup()])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, SSL_get_current_compression, [
AC_DEFINE(HAVE_SSL_COMPRESSION,, [Build with OpenSSL compression])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, SSL_get_servername, [
AC_DEFINE(HAVE_SSL_GET_SERVERNAME,, [Build with TLS hostname support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, SSL_COMP_free_compression_methods, [
AC_DEFINE(HAVE_SSL_COMP_FREE_COMPRESSION_METHODS,, [Build with SSL_COMP_free_compression_methods() support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, RSA_generate_key_ex, [
AC_DEFINE(HAVE_RSA_GENERATE_KEY_EX,, [Build with RSA_generate_key_ex() support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, ASN1_STRING_get0_data, [
AC_DEFINE(HAVE_ASN1_STRING_GET0_DATA,, [Build with ASN1_STRING_get0_data() support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, HMAC_CTX_new, [
AC_DEFINE(HAVE_HMAC_CTX_NEW,, [Build with HMAC_CTX_new() support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, EVP_MD_CTX_new, [
AC_DEFINE(HAVE_EVP_MD_CTX_NEW,, [Build with EVP_MD_CTX_new() support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, OBJ_length, [
AC_DEFINE(HAVE_OBJ_LENGTH,, [Build with OBJ_length() support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, EVP_PKEY_get0_RSA, [
AC_DEFINE(HAVE_EVP_PKEY_get0,, [Build with EVP_PKEY_get0_*() support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, SSL_CTX_set_ciphersuites, [
AC_DEFINE(HAVE_SSL_CTX_SET_CIPHERSUITES,, [Build with SSL_CTX_set_ciphersuites() support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, BN_secure_new, [
AC_DEFINE(HAVE_BN_SECURE_NEW,, [Build with BN_secure_new support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, RSA_set0_key, [
AC_DEFINE(HAVE_RSA_SET0_KEY,, [Build with RSA_set0_key support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, RSA_set0_factors, [
AC_DEFINE(HAVE_RSA_SET0_FACTORS,, [Build with RSA_set0_factors support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, RSA_set0_crt_params, [
AC_DEFINE(HAVE_RSA_SET0_CRT_PARAMS,, [Build with RSA_set0_crt_params support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, ECDSA_SIG_get0, [
AC_DEFINE(HAVE_ECDSA_SIG_GET0,, [Build with ECDSA_SIG_get0 support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, ECDSA_SIG_set0, [
AC_DEFINE(HAVE_ECDSA_SIG_SET0,, [Build with ECDSA_SIG_set0 support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, EC_GROUP_order_bits, [
AC_DEFINE(HAVE_EC_GROUP_order_bits,, [Build with EC_GROUP_order_bits support])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, X509_check_host, [
AC_DEFINE(HAVE_X509_CHECK_HOST,, [OpenSSL supports X509_check_host()])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, X509_check_ip, [
AC_DEFINE(HAVE_X509_CHECK_IP,, [OpenSSL supports X509_check_ip()])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, X509_check_ip_asc, [
AC_DEFINE(HAVE_X509_CHECK_IP_ASC,, [OpenSSL supports X509_check_ip_asc()])
],, $SSL_LIBS)
AC_CHECK_LIB(ssl, [EVP_PKEY_CTX_new_id], [have_evp_pkey_ctx_new_id="yes"],, $SSL_LIBS)
AC_CHECK_LIB(ssl, [EC_KEY_new], [have_ec_key_new="yes"],, $SSL_LIBS)
if test "$have_evp_pkey_ctx_new_id" = "yes" && test "$have_ec_key_new" = "yes"; then
build_dcrypt_openssl="yes"
else
AC_MSG_WARN([No ECC support in OpenSSL - not enabling dcrypt])
fi
fi
fi
AM_CONDITIONAL(BUILD_OPENSSL, test "$have_openssl" = "yes")
AM_CONDITIONAL(BUILD_DCRYPT_OPENSSL, test "$build_dcrypt_openssl" = "yes")
AM_CONDITIONAL([SSL_VERSION_GE_102], [test x$ssl_version_ge_102 = xtrue])
if test $want_gnutls != no && test $have_ssl = no; then
AC_CHECK_LIB(gnutls, gnutls_global_init, [
AC_CHECK_HEADER(gnutls/gnutls.h, [
AC_DEFINE(HAVE_GNUTLS,, [Build with GNUTLS support])
SSL_LIBS="-lgnutls -lgcrypt"
AC_SUBST(SSL_LIBS)
have_ssl="yes (GNUTLS)"
have_gnutls=yes
], [
if test $want_gnutls = yes; then
AC_ERROR([Can't build with GNUTLS: gnutls/gnutls.h not found])
fi
])
], [
if test $want_gnutls = yes; then
AC_ERROR([Can't build with GNUTLS: libgnutls not found])
fi
], -lgcrypt)
fi
if test "$have_ssl" != "no"; then
AC_DEFINE(HAVE_SSL,, [Build with SSL/TLS support])
fi
])
|
