diff options
Diffstat (limited to 'configure.ac')
| -rw-r--r-- | configure.ac | 50 |
1 files changed, 44 insertions, 6 deletions
diff --git a/configure.ac b/configure.ac index 379cd74..82e8bb7 100644 --- a/configure.ac +++ b/configure.ac @@ -149,6 +149,7 @@ fi use_stack_protector=1 use_toolchain_hardening=1 +use_retpoline=1 AC_ARG_WITH([stackprotect], [ --without-stackprotect Don't use compiler's stack protection], [ if test "x$withval" = "xno"; then @@ -159,6 +160,11 @@ AC_ARG_WITH([hardening], if test "x$withval" = "xno"; then use_toolchain_hardening=0 fi ]) +AC_ARG_WITH([retpoline], + [ --without-retpoline Enable retpoline spectre mitigation], [ + if test "x$withval" = "xno"; then + use_retpoline=0 + fi ]) # We use -Werror for the tests only so that we catch warnings like "this is # on by default" for things like -fPIE. @@ -216,8 +222,6 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then OSSH_CHECK_CFLAG_COMPILE([-Wbitwise-instead-of-logical]) OSSH_CHECK_CFLAG_COMPILE([-fno-strict-aliasing]) if test "x$use_toolchain_hardening" = "x1"; then - OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang - OSSH_CHECK_LDFLAG_LINK([-Wl,-z,retpolineplt]) OSSH_CHECK_CFLAG_COMPILE([-D_FORTIFY_SOURCE=2]) OSSH_CHECK_LDFLAG_LINK([-Wl,-z,relro]) OSSH_CHECK_LDFLAG_LINK([-Wl,-z,now]) @@ -240,6 +244,10 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then esac OSSH_CHECK_CFLAG_COMPILE([-ftrivial-auto-var-init=zero]) fi + if test "x$use_retpoline" = "x1"; then + OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang + OSSH_CHECK_LDFLAG_LINK([-Wl,-z,retpolineplt]) + fi AC_MSG_CHECKING([if $CC accepts -fno-builtin-memset]) saved_CFLAGS="$CFLAGS" @@ -2067,6 +2075,18 @@ AC_ARG_WITH([security-key-builtin], [ enable_sk_internal=$withval ] ) +disable_ecdsa= +AC_ARG_ENABLE([dsa-keys], + [ --disable-dsa-keys disable DSA key support [no]], + [ + if test "x$enableval" = "xno" ; then + disable_ecdsa=1 + fi + ] +) +test -z "$disable_ecdsa" && + AC_DEFINE([WITH_DSA], [1], [Define if to enable DSA keys.]) + AC_SEARCH_LIBS([dlopen], [dl]) AC_CHECK_FUNCS([dlopen]) AC_CHECK_DECL([RTLD_NOW], [], [], [#include <dlfcn.h>]) @@ -2723,7 +2743,15 @@ AC_ARG_WITH([ssl-dir], else CPPFLAGS="-I${withval} ${CPPFLAGS}" fi - openssl_bin_PATH="${PATH}${PATH_SEPARATOR}${withval}/bin${PATH_SEPARATOR}${withval}/apps" + dnl Ensure specified openssl binary works, eg it can + dnl find its runtime libraries, before trying to use. + if test -x "${withval}/bin/openssl" && \ + "${withval}/bin/openssl" version >/dev/null 2>&1; then + openssl_bin_PATH="${withval}/bin${PATH_SEPARATOR}${PATH}" + elif test -x "${withval}/apps/openssl" && \ + "${withval}/apps/openssl" version >/dev/null 2>&1; then + openssl_bin_PATH="${withval}/apps${PATH_SEPARATOR}${PATH}" + fi fi ] ) @@ -2790,8 +2818,8 @@ if test "x$openssl" = "xyes" ; then AC_MSG_RESULT([$ssl_header_ver]) ], [ - AC_MSG_RESULT([not found]) - AC_MSG_ERROR([OpenSSL version header not found.]) + AC_MSG_RESULT([failed]) + AC_MSG_ERROR([OpenSSL version test program failed.]) ], [ AC_MSG_WARN([cross compiling: not checking]) @@ -2994,7 +3022,7 @@ if test "x$openssl" = "xyes" ; then fi # Check for OpenSSL without EVP_aes_{192,256}_cbc - AC_MSG_CHECKING([whether OpenSSL has crippled AES support]) + AC_MSG_CHECKING([whether OpenSSL lacks support for AES 192/256]) AC_LINK_IFELSE( [AC_LANG_PROGRAM([[ #include <stdlib.h> @@ -5293,6 +5321,16 @@ AC_DEFINE_UNQUOTED([_PATH_SSH_PIDDIR], ["$piddir"], [Specify location of ssh.pid]) AC_SUBST([piddir]) + +AC_ARG_ENABLE([fd-passing], + [ --disable-fd-passing disable file descriptor passsing [no]], + [ + if test "x$enableval" = "xno" ; then + AC_DEFINE([DISABLE_FD_PASSING]) + fi + ] +) + dnl allow user to disable some login recording features AC_ARG_ENABLE([lastlog], [ --disable-lastlog disable use of lastlog even if detected [no]], |