configure.ac

# wolfssh
# Copyright (C) 2014-2026 wolfSSL Inc.
# All right reserved.

AC_COPYRIGHT([Copyright (C) 2014-2026 wolfSSL Inc.])
AC_INIT([wolfssh],[1.6.0],[support@wolfssl.com],[wolfssh],[https://www.wolfssl.com])
AC_PREREQ([2.69])
AC_CONFIG_AUX_DIR([build-aux])

: ${CFLAGS=""}

AC_CANONICAL_HOST
AC_CANONICAL_TARGET

AM_INIT_AUTOMAKE([1.14.1 -Wall -Werror -Wno-portability foreign tar-ustar subdir-objects no-define color-tests])

AC_ARG_PROGRAM
AC_CONFIG_MACRO_DIR([m4])
AC_CONFIG_HEADERS([config.h])

WOLFSSH_LIBRARY_VERSION=21:0:3
#                        | | |
#                  +-----+ | +----+
#                  |       |      |
#               current:revision:age
#                  |       |      |
#                  |       |      +- increment if interfaces have been added
#                  |       |      +- set to zero if interfaces have been
#                  |       |           removed or changed
#                  |       +- increment if source code has changed
#                  |       +- set to zero if current is incremented
#                  +- increment if interfaces have been added, removed
#                       or changed
AC_SUBST([WOLFSSH_LIBRARY_VERSION])

LT_PREREQ([2.4.3])
LT_INIT([disable-static win32-dll])

gl_VISIBILITY
AS_IF([test -n "$CFLAG_VISIBILITY"],[AM_CFLAGS="$AM_CFLAGS $CFLAG_VISIBILITY"])

# silent
m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])

# Checks for programs.
AC_PROG_CC
AM_PROG_CC_C_O
AC_PROG_INSTALL

# Checks for type sizes.
AC_CHECK_SIZEOF([long long])
AC_CHECK_SIZEOF([long])
AC_CHECK_SIZEOF([off_t])
AC_TYPE_SIZE_T
AC_TYPE_UINT8_T
AC_TYPE_UINTPTR_T

# Check headers/libs
AC_CHECK_HEADERS([limits.h sys/select.h sys/time.h sys/ioctl.h pty.h util.h termios.h])
AC_CHECK_LIB([network],[socket])

# Probe forkpty through its header. AC_CHECK_LIB's bare declaration has no
# extern "C", so the link fails under CC=g++.
AC_MSG_CHECKING([for forkpty in -lutil])
SAVED_LIBS="$LIBS"
LIBS="-lutil $LIBS"
AC_LINK_IFELSE(
  [AC_LANG_PROGRAM([[#include <stddef.h>
                     #ifdef HAVE_PTY_H
                     #include <pty.h>
                     #endif
                     #ifdef HAVE_UTIL_H
                     #include <util.h>
                     #endif]],
                   [[int fd; return (int)forkpty(&fd, NULL, NULL, NULL);]])],
  [AC_MSG_RESULT([yes])],
  [AC_MSG_RESULT([no])
   LIBS="$SAVED_LIBS"])

#wolfssl
AC_MSG_CHECKING([for wolfSSL])
if test "x$prefix" = "xNONE"
then
    wcpath=$ac_default_prefix
else
    wcpath=$prefix
fi
AC_MSG_NOTICE([prefix ${prefix}])
WOLFSSL_URL="http://www.wolfssl.com/download.html"
AC_ARG_WITH(wolfssl,
  [AS_HELP_STRING([--with-wolfssl=PATH], [PATH to wolfssl install (default /usr/local)])],
  [
    if test "x$withval" != "xno" ; then
      if test -d "${withval}/lib" && test -d "${withval}/include"; then
        wcpath=${withval}

        LDFLAGS="-L${wcpath}/lib $LDFLAGS"
        CPPFLAGS="-I${wcpath}/include $CPPFLAGS"
      else
        AC_MSG_ERROR([wolfSSL path error (${withval}): missing lib and include])
      fi
    fi
  ]
)

# Probe the wolfSSL functions through their headers. AC_CHECK_LIB and
# AC_CHECK_FUNCS declare the symbol without extern "C", so with CC=g++ the
# link looks for a mangled name and fails.
# The cache variable keeps AC_CHECK_LIB's name so a preset
# ac_cv_lib_wolfssl_wolfCrypt_Init=yes still skips the link test.
LIBS="-lwolfssl $LIBS"
AC_CACHE_CHECK([for wolfCrypt_Init in -lwolfssl],
  [ac_cv_lib_wolfssl_wolfCrypt_Init],
  [AC_LINK_IFELSE(
    [AC_LANG_PROGRAM([[#ifdef WOLFSSL_USER_SETTINGS
                       #include <wolfssl/wolfcrypt/settings.h>
                       #else
                       #include <wolfssl/options.h>
                       #endif
                       #include <wolfssl/wolfcrypt/wc_port.h>]],
                     [[return wolfCrypt_Init();]])],
    [ac_cv_lib_wolfssl_wolfCrypt_Init=yes],
    [ac_cv_lib_wolfssl_wolfCrypt_Init=no])])
AS_IF([test "x$ac_cv_lib_wolfssl_wolfCrypt_Init" != "xyes"],
  [AC_MSG_ERROR([libwolfssl is required for ${PACKAGE}. It can be obtained from https://www.wolfssl.com/download.html/ .])])

AC_MSG_CHECKING([for wc_ecc_set_rng])
AC_LINK_IFELSE(
  [AC_LANG_PROGRAM([[#ifdef WOLFSSL_USER_SETTINGS
                     #include <wolfssl/wolfcrypt/settings.h>
                     #else
                     #include <wolfssl/options.h>
                     #endif
                     #include <wolfssl/wolfcrypt/ecc.h>]],
                   [[return wc_ecc_set_rng(NULL, NULL);]])],
  [AC_DEFINE([HAVE_WC_ECC_SET_RNG], [1],
             [Define to 1 if you have the `wc_ecc_set_rng' function.])
   AC_MSG_RESULT([yes])],
  [AC_MSG_RESULT([no])])

AC_CHECK_FUNCS([gethostbyname getaddrinfo gettimeofday inet_ntoa memset socket socketpair])

# Check if the wc_MlDsaKey_MakePublicKey API is available.
# The declaration is ML-DSA config-gated, so probe through the real header.
AC_MSG_CHECKING([for wc_MlDsaKey_MakePublicKey])
AC_LINK_IFELSE(
  [AC_LANG_PROGRAM([[#include <wolfssl/options.h>
#include <wolfssl/wolfcrypt/wc_mldsa.h>]],
                   [[(void)wc_MlDsaKey_MakePublicKey(NULL);]])],
  [AC_DEFINE([WOLFSSH_HAVE_MLDSA_DERIVE_PUB], [1],
             [wc_MlDsaKey_MakePublicKey() available and declared])
   AC_MSG_RESULT([yes])],
  [AC_MSG_RESULT([no])])

# futimens()/utimensat() declarations are feature-test-macro gated, so a plain
# AC_CHECK_FUNCS link test can pass while the prototype stays hidden at compile
# time. Probe through the real header so a positive result is build-safe.
AC_MSG_CHECKING([for futimens])
AC_LINK_IFELSE(
  [AC_LANG_PROGRAM([[#include <sys/stat.h>
#include <time.h>]],
                   [[struct timespec ts[2]; (void)futimens(0, ts);]])],
  [AC_DEFINE([HAVE_FUTIMENS], [1], [futimens() available and declared])
   AC_MSG_RESULT([yes])],
  [AC_MSG_RESULT([no])])

AC_MSG_CHECKING([for futimes])
AC_LINK_IFELSE(
  [AC_LANG_PROGRAM([[#include <sys/time.h>]],
                   [[struct timeval tv[2]; (void)futimes(0, tv);]])],
  [AC_DEFINE([HAVE_FUTIMES], [1], [futimes() available and declared])
   AC_MSG_RESULT([yes])],
  [AC_MSG_RESULT([no])])

AC_MSG_CHECKING([for utimensat])
AC_LINK_IFELSE(
  [AC_LANG_PROGRAM([[#include <fcntl.h>
#include <sys/stat.h>
#include <time.h>]],
                   [[struct timespec ts[2];
                     (void)utimensat(AT_FDCWD, "x", ts, AT_SYMLINK_NOFOLLOW);]])],
  [AC_DEFINE([HAVE_UTIMENSAT], [1], [utimensat() available and declared])
   AC_MSG_RESULT([yes])],
  [AC_MSG_RESULT([no])])

# The layout of struct WOLFSSH depends on this result through
# WOLFSSH_HAVE_DIRFD, so port.h keys on it alone; O_DIRECTORY is probed here
# rather than tested per translation unit, where feature macros could differ.
AC_MSG_CHECKING([for openat, mkdirat, faccessat and O_DIRECTORY])
AC_LINK_IFELSE(
  [AC_LANG_PROGRAM([[#include <fcntl.h>
#include <sys/stat.h>
#include <unistd.h>]],
                   [[(void)openat(AT_FDCWD, "x", O_RDONLY | O_DIRECTORY, 0);
                     (void)mkdirat(AT_FDCWD, "x", 0755);
                     (void)faccessat(AT_FDCWD, "x", X_OK, AT_EACCESS);]])],
  [AC_DEFINE([HAVE_OPENAT], [1],
             [openat(), mkdirat(), faccessat() and O_DIRECTORY available])
   AC_MSG_RESULT([yes])],
  [AC_MSG_RESULT([no])])

AC_MSG_CHECKING([for linkat])
AC_LINK_IFELSE(
  [AC_LANG_PROGRAM([[#include <fcntl.h>
#include <unistd.h>]],
                   [[(void)linkat(AT_FDCWD, "x", AT_FDCWD, "y", 0);]])],
  [AC_DEFINE([HAVE_LINKAT], [1], [linkat() available and declared])
   AC_MSG_RESULT([yes])],
  [AC_MSG_RESULT([no])])

AC_CHECK_DECLS([[pread],[pwrite]],,[unistd.h])

# DEBUG
DEBUG_CFLAGS="-g -O0"
DEBUG_CPPFLAGS="-DDEBUG -DDEBUG_WOLFSSH"

AX_DEBUG
AS_IF([test "x$ax_enable_debug" = "xyes"],
      [AM_CFLAGS="$DEBUG_CFLAGS $AM_CFLAGS"
       AM_CPPFLAGS="$DEBUG_CPPFLAGS $AM_CPPFLAGS"],
      [AM_CFLAGS="$AM_CFLAGS -O2"
       AM_CPPFLAGS="-DNDEBUG $AM_CPPFLAGS"])

AX_PTHREAD([
    AC_DEFINE([HAVE_PTHREAD], [1], [Define if you have POSIX threads libraries and header files.])
    # If AX_PTHREAD is adding -Qunused-arguments, need to prepend with
    # -Xcompiler libtool will use it. Newer versions of clang don't need
    # the -Q flag when using pthreads.
    AS_CASE([$PTHREAD_CFLAGS],[-Qunused-arguments*],[PTHREAD_CFLAGS="-Xcompiler $PTHREAD_CFLAGS"])
    AM_CFLAGS="$AM_CFLAGS $PTHREAD_CFLAGS"])

AX_AM_JOBSERVER([yes])

# Inline Build
AC_ARG_ENABLE([inline],
    [AS_HELP_STRING([--disable-inline],[Disable inline functions (default: enabled)])],
    [ENABLED_INLINE=$enableval],[ENABLED_INLINE=yes])

# Examples Build
AC_ARG_ENABLE([examples],
    [AS_HELP_STRING([--disable-examples],[Disable examples (default: enabled)])],
    [ENABLED_EXAMPLES=$enableval],[ENABLED_EXAMPLES=yes])

# Remove server code
AC_ARG_ENABLE([server],
    [AS_HELP_STRING([--disable-server],[Disable server code (default: enabled)])],
    [ENABLED_SERVER=$enableval],[ENABLED_SERVER=yes])

# Remove client code
AC_ARG_ENABLE([client],
    [AS_HELP_STRING([--disable-client],[Disable client code (default: enabled)])],
    [ENABLED_CLIENT=$enableval],[ENABLED_CLIENT=yes])

# Key Generation
AC_ARG_ENABLE([keygen],
    [AS_HELP_STRING([--enable-keygen],[Enable key generation (default: disabled)])],
    [ENABLED_KEYGEN=$enableval],[ENABLED_KEYGEN=no])

# Keyboard Interactive
AC_ARG_ENABLE([keyboard-interactive],
    [AS_HELP_STRING([--enable-keyboard-interactive],[Enable keyboard interactive authentication (default: disabled)])],
    [ENABLED_KEYBOARD_INTERACTIVE=$enableval],[ENABLED_KEYBOARD_INTERACTIVE=no])

# SCP
AC_ARG_ENABLE([scp],
    [AS_HELP_STRING([--enable-scp],[Enable scp support (default: disabled)])],
    [ENABLED_SCP=$enableval],[ENABLED_SCP=no])

# SFTP
AC_ARG_ENABLE([sftp],
    [AS_HELP_STRING([--enable-sftp],[Enable SFTP support (default: disabled)])],
    [ENABLED_SFTP=$enableval],[ENABLED_SFTP=no])

# SFTP buffer zeroization
AC_ARG_ENABLE([sftp-zeroize],
    [AS_HELP_STRING([--disable-sftp-zeroize],[Disable zeroization of SFTP file payload buffers before free (default: enabled)])],
    [ENABLED_SFTP_ZEROIZE=$enableval],[ENABLED_SFTP_ZEROIZE=yes])

# SSHD
AC_ARG_ENABLE([sshd],
    [AS_HELP_STRING([--enable-sshd],[Enable SSHD support (default: disabled)])],
    [ENABLED_SSHD=$enableval],[ENABLED_SSHD=no])

# SSH Client
AC_ARG_ENABLE([sshclient],
    [AS_HELP_STRING([--enable-sshclient],[Enable SSH client app (default: disabled)])],
    [ENABLED_SSHCLIENT=$enableval],[ENABLED_SSHCLIENT=no])

# TCP/IP Forwarding
AC_ARG_ENABLE([fwd],
    [AS_HELP_STRING([--enable-fwd],[Enable TCP/IP Forwarding support (default: disabled)])],
    [ENABLED_FWD=$enableval],[ENABLED_FWD=no])

# pseudo-terminal
AC_ARG_ENABLE([term],
    [AS_HELP_STRING([--disable-term],[Disable pseudo-terminal support (default: enabled)])],
    [ENABLED_TERM=$enableval],[ENABLED_TERM=yes])

# shell support
AC_ARG_ENABLE([shell],
    [AS_HELP_STRING([--enable-shell],[Enable echoserver shell support (default: disabled)])],
    [ENABLED_SHELL=$enableval],[ENABLED_SHELL=no])

# ssh-agent
AC_ARG_ENABLE([agent],
    [AS_HELP_STRING([--enable-agent],[Enable ssh-agent support (default: disabled)])],
    [ENABLED_AGENT=$enableval],[ENABLED_AGENT=no])

# X.509 certs
AC_ARG_ENABLE([certs],
    [AS_HELP_STRING([--enable-certs],[Enable X.509 cert support (default: disabled)])],
    [ENABLED_CERTS=$enableval],[ENABLED_CERTS=no])

# OpenSSH certs
AC_ARG_ENABLE([ossh-certs],
    [AS_HELP_STRING([--enable-ossh-certs],[Enable OpenSSH certificate user auth (default: disabled)])],
    [ENABLED_OSSH_CERTS=$enableval],[ENABLED_OSSH_CERTS=no])

# Windows certificate store (host/client keys)
AC_ARG_ENABLE([windows-cert-store],
    [AS_HELP_STRING([--enable-windows-cert-store],[Enable Windows certificate store integration for keys (default: disabled)])],
    [ENABLED_WINDOWS_CERT_STORE=$enableval],
    [ENABLED_WINDOWS_CERT_STORE=no])

# TPM 2.0 Support
AC_ARG_ENABLE([tpm],
    [AS_HELP_STRING([--enable-tpm],[Enable TPM 2.0 support (default: disabled)])],
    [ENABLED_TPM=$enableval],[ENABLED_TPM=no])

# smallstack
AC_ARG_ENABLE([smallstack],
    [AS_HELP_STRING([--enable-smallstack],[Enable small stack (default: disabled)])],
    [ENABLED_SMALLSTACK=$enableval],[ENABLED_SMALLSTACK=no])

# Allow "none" cipher/MAC
AC_ARG_ENABLE([none-cipher],
    [AS_HELP_STRING([--enable-none-cipher],[Allow negotiating the insecure "none" cipher/MAC, disabling encryption/integrity (default: disabled)])],
    [ENABLED_NONE_CIPHER=$enableval],[ENABLED_NONE_CIPHER=no])

# use PAM lib
AC_ARG_WITH([pam],
    [AS_HELP_STRING([--with-pam=PATH],[PATH to directory with the PAM library])],
    [PAM_LIB=$withval],
    [PAM_LIB=""])

# Enable All
AC_ARG_ENABLE([all],
    [AS_HELP_STRING([--enable-all],[Enable all wolfSSH features (default: disabled)])],
    [ENABLED_ALL=$enableval],[ENABLED_ALL=no])

# Distro build
AC_ARG_ENABLE([distro],
    [AS_HELP_STRING([--enable-distro],[Enable wolfSSH distro build (default: disabled)])],
    [ENABLED_DISTRO=$enableval],[ENABLED_DISTRO=no])

# Update the ENABLED flags for options that affect other options.
AS_IF([test "x$ENABLED_DISTRO" = "xyes"],
      [ENABLED_ALL=yes; enable_shared=yes; enable_static=yes])
AS_IF([test "x$ENABLED_ALL" = "xyes"],
      [ENABLED_KEYGEN=yes; ENABLED_SCP=yes; ENABLED_SFTP=yes; ENABLED_FWD=yes; ENABLED_SHELL=yes; ENABLED_AGENT=yes; ENABLED_SSHD=yes; ENABLED_SSHCLIENT=yes; ENABLED_CERTS=yes; ENABLED_KEYBOARD_INTERACTIVE=yes])

# The apps need the side of the library they run on. Asking for one outright
# without its side is an error; getting it from --enable-all only drops it.
AS_IF([test "x$ENABLED_SERVER" = "xno" && test "x$ENABLED_SSHD" = "xyes"],
      [AS_IF([test "x$enable_sshd" = "xyes"],
             [AC_MSG_ERROR([--enable-sshd requires the server, leave out --disable-server.])],
             [ENABLED_SSHD=no])])
AS_IF([test "x$ENABLED_CLIENT" = "xno" && test "x$ENABLED_SSHCLIENT" = "xyes"],
      [AS_IF([test "x$enable_sshclient" = "xyes"],
             [AC_MSG_ERROR([--enable-sshclient requires the client, leave out --disable-client.])],
             [ENABLED_SSHCLIENT=no])])

AS_IF([test "x$ENABLED_SSHD" = "xyes"],
      [ENABLED_SHELL=yes])

# The client app runs every session's I/O on threads, so it needs a threaded
# wolfSSL. Probe for the macro rather than trust the flags, it arrives through
# wolfSSL's options.h. Asking for the client outright is an error; getting it
# from --enable-all only drops it, so --enable-all still works here.
AS_IF([test "x$ENABLED_SSHCLIENT" = "xyes"],[
  AC_MSG_CHECKING([whether wolfSSL is single threaded])
  AC_COMPILE_IFELSE(
    [AC_LANG_PROGRAM([[#ifdef WOLFSSL_USER_SETTINGS
                       #include <wolfssl/wolfcrypt/settings.h>
                       #else
                       #include <wolfssl/options.h>
                       #endif]],
                     [[#ifndef SINGLE_THREADED
                       #error "threaded"
                       #endif]])],
    [AC_MSG_RESULT([yes])
     AS_IF([test "x$enable_sshclient" = "xyes"],
           [AC_MSG_ERROR([--enable-sshclient requires a threaded wolfSSL.])],
           [AC_MSG_NOTICE([single threaded wolfSSL, not building the ssh client app])
            ENABLED_SSHCLIENT=no])],
    [AC_MSG_RESULT([no])])])

# Set the defined flags for the code.
AS_IF([test "x$ENABLED_INLINE" = "xno"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DNO_INLINE"])
AS_IF([test "x$ENABLED_SERVER" = "xno"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DNO_WOLFSSH_SERVER"])
AS_IF([test "x$ENABLED_CLIENT" = "xno"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DNO_WOLFSSH_CLIENT"])
AS_IF([test "x$ENABLED_KEYGEN" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_KEYGEN"])
AS_IF([test "x$ENABLED_KEYBOARD_INTERACTIVE" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_KEYBOARD_INTERACTIVE"])
AS_IF([test "x$ENABLED_SCP" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_SCP"])
AS_IF([test "x$ENABLED_SFTP" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_SFTP"])
AS_IF([test "x$ENABLED_SFTP_ZEROIZE" = "xno"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_NO_SFTP_BUFFER_ZERO"])
AS_IF([test "x$ENABLED_FWD" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_FWD"])
AS_IF([test "x$ENABLED_TERM" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_TERM"])
AS_IF([test "x$ENABLED_SHELL" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_SHELL"])
AS_IF([test "x$ENABLED_AGENT" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_AGENT"])
AS_IF([test "x$ENABLED_CERTS" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_CERTS"])
AS_IF([test "x$ENABLED_OSSH_CERTS" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_OSSH_CERTS"])
dnl Initialize before the feature block so a stray WINCERT_LIBS value in the
dnl environment is never silently appended to LIBS for an unrelated build.
WINCERT_LIBS=
AS_IF([test "x$ENABLED_WINDOWS_CERT_STORE" = "xyes"],
    [AS_IF([test "x$ENABLED_CERTS" != "xyes"],
        [AC_MSG_ERROR([--enable-windows-cert-store requires X.509 cert support (--enable-certs)])])
     AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_WINDOWS_CERT_STORE"
     dnl Only the mingw triplets define _WIN32, which wolfssh/internal.h
     dnl requires. MSYS/Cygwin toolchains do not.
     dnl Accumulate the libraries in WINCERT_LIBS; they are appended to LIBS
     dnl after the remaining AC_CHECK_LIB/AX_HARDEN_CC_COMPILER_FLAGS probes
     dnl so a missing libncrypt cannot make those probes fail with unrelated
     dnl error messages.
     AS_CASE([$host],
         [*mingw*],[WINCERT_LIBS="-lcrypt32 -lncrypt"],
         [AC_MSG_ERROR([--enable-windows-cert-store is only supported on _WIN32 Windows hosts (mingw)])])
     dnl Fail at configure time, not first link, when the SDK headers are
     dnl absent. The link libraries are stock mingw import libs, so probing
     dnl the headers is enough and keeps working without a cross-built
     dnl wolfSSL installed.
     AC_CHECK_HEADERS([windows.h],,
         [AC_MSG_ERROR([windows.h not found; --enable-windows-cert-store needs the Windows SDK headers])])
     AC_CHECK_HEADERS([wincrypt.h ncrypt.h],,
         [AC_MSG_ERROR([wincrypt.h/ncrypt.h not found; --enable-windows-cert-store needs the Windows SDK headers])],
         [[#include <windows.h>]])])
AS_IF([test "x$ENABLED_SMALLSTACK" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_SMALL_STACK"])
AS_IF([test "x$ENABLED_NONE_CIPHER" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_ALLOW_NONE_CIPHER"])
dnl The client app shows host key fingerprints and writes known_hosts
dnl entries, both base64. wolfSSL only enables its encoder by default on
dnl x86_64, so check for it rather than fail later on a hidden prototype.
AS_IF([test "x$ENABLED_SSHCLIENT" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_SSHCLIENT"
       AC_MSG_CHECKING([for Base64_Encode_NoNl])
       AC_LINK_IFELSE(
         [AC_LANG_PROGRAM([[#include <wolfssl/options.h>
#include <wolfssl/wolfcrypt/coding.h>]],
                          [[byte out[8];
                            word32 outSz = sizeof(out);
                            (void)Base64_Encode_NoNl((const byte*)"x", 1,
                                    out, &outSz);]])],
         [AC_MSG_RESULT([yes])],
         [AC_MSG_RESULT([no])
          AC_MSG_ERROR([the SSH client app needs base64 encoding for host key fingerprints and known_hosts entries. Rebuild wolfSSL with --enable-base64encode, or leave out --enable-sshclient.])])])
AS_IF([test "x$ENABLED_TPM" = "xyes"],
      [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_TPM"
       AC_MSG_CHECKING([for wolfTPM2_Init in -lwolftpm])
       LIBS="-lwolftpm $LIBS"
       AC_LINK_IFELSE(
         [AC_LANG_PROGRAM([[#include <wolftpm/tpm2_wrap.h>]],
                          [[return wolfTPM2_Init(NULL, NULL, NULL);]])],
         [AC_MSG_RESULT([yes])],
         [AC_MSG_RESULT([no])
          AC_MSG_ERROR([libwolftpm is required for ${PACKAGE}. It can be obtained from https://www.wolfssl.com/download.html/ .])])])
AS_IF([test "x$ENABLED_SSHD" = "xyes"],[
  AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_SSHD"
  AS_IF([test -n "$PAM_LIB"],[
    AC_MSG_CHECKING([for directory $PAM_LIB])
    AS_IF([! test -d "$PAM_LIB"],[AC_MSG_ERROR([PAM lib dir $PAM_LIB not found.])])
    AC_MSG_RESULT([yes])
    AM_LDFLAGS="-L$PAM_LIB $AM_LDFLAGS"
    LIBS="$LIBS -lpam"
    AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_USE_PAM"
    #TODO check on link to lib
    #AC_CHECK_LIB([pam], [pam],
    # [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_USE_PAM"; LIBS="$LIBS -lpam"],
    # [AC_MSG_ERROR(libpam not found)])
  ],[
    AS_CASE([$host],
      [*qnx*],[
        # QNX uses liblogin for crypt operation
        AC_CHECK_LIB([login],[login],
          [AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_HAVE_LIBLOGIN"; LIBS="$LIBS -llogin"],
          [AC_MSG_ERROR(liblogin not found)])],
      [*darwin*],[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_HAVE_LIBCRYPT"],
      [AC_MSG_CHECKING([for crypt in -lcrypt])
       LIBS="$LIBS -lcrypt"
       AC_LINK_IFELSE(
         [AC_LANG_PROGRAM([[#ifndef _XOPEN_SOURCE
                            #define _XOPEN_SOURCE
                            #endif
                            #ifndef _GNU_SOURCE
                            #define _GNU_SOURCE
                            #endif
                            #include <unistd.h>]],
                          [[return crypt("x", "xx") == NULL;]])],
         [AC_MSG_RESULT([yes])
          AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_HAVE_LIBCRYPT"],
         [AC_MSG_RESULT([no])
          AC_MSG_ERROR(libcrypt not found)])])
    # crypt_r() keeps the hash in a buffer the daemon can wipe. Probe through
    # <crypt.h> so a positive result is build-safe; macOS has neither.
    AC_MSG_CHECKING([for crypt_r])
    AC_LINK_IFELSE(
      [AC_LANG_PROGRAM([[#include <crypt.h>]],
                       [[struct crypt_data d; d.initialized = 0;
                         (void)crypt_r("", "", &d);]])],
      [AC_DEFINE([HAVE_CRYPT_R], [1], [crypt_r() available and declared])
       AC_MSG_RESULT([yes])],
      [AC_MSG_RESULT([no])])
  ])
  # Only the five-argument glibc/musl form; QNX and Solaris have four.
  AC_MSG_CHECKING([for getspnam_r])
  AC_LINK_IFELSE(
    [AC_LANG_PROGRAM([[#include <shadow.h>]],
                     [[struct spwd sp; struct spwd* res; char buf[64];
                       int rc = getspnam_r("", &sp, buf, sizeof(buf), &res);
                       (void)rc;]])],
    [AC_DEFINE([HAVE_GETSPNAM_R], [1], [five-argument getspnam_r() available])
     AC_MSG_RESULT([yes])],
    [AC_MSG_RESULT([no])])
])

AC_CONFIG_LINKS([keys/gretel-key-rsa.pub:keys/gretel-key-rsa.pub
                 keys/gretel-key-rsa.pem:keys/gretel-key-rsa.pem
                 keys/gretel-key-ecc.pub:keys/gretel-key-ecc.pub
                 keys/gretel-key-ecc.pem:keys/gretel-key-ecc.pem
                 keys/server-key-rsa.der:keys/server-key-rsa.der
                 keys/server-key-ecc.der:keys/server-key-ecc.der
                 keys/server-key-ecc-521.der:keys/server-key-ecc-521.der
                 keys/server-key-ed25519.der:keys/server-key-ed25519.der
                 keys/ca-cert-ecc.der:keys/ca-cert-ecc.der
                 keys/ca-key-ecc.der:keys/ca-key-ecc.der
                 keys/server-cert.der:keys/server-cert.der
                 keys/fred-cert.der:keys/fred-cert.der
                 keys/fred-key.der:keys/fred-key.der])

# Set the automake conditionals.
AM_CONDITIONAL([BUILD_SERVER],[test "x$ENABLED_SERVER" = "xyes"])
AM_CONDITIONAL([BUILD_CLIENT],[test "x$ENABLED_CLIENT" = "xyes"])
AM_CONDITIONAL([BUILD_EXAMPLE_SERVERS],[test "x$ENABLED_EXAMPLES" = "xyes"])
AM_CONDITIONAL([BUILD_EXAMPLE_CLIENTS],[test "x$ENABLED_EXAMPLES" = "xyes"])
AM_CONDITIONAL([BUILD_INLINE],[test "x$ENABLED_INLINE" = "xyes"])
AM_CONDITIONAL([BUILD_KEYGEN],[test "x$ENABLED_KEYGEN" = "xyes"])
AM_CONDITIONAL([BUILD_SCP],[test "x$ENABLED_SCP" = "xyes"])
AM_CONDITIONAL([BUILD_SFTP],[test "x$ENABLED_SFTP" = "xyes"])
AM_CONDITIONAL([BUILD_FWD],[test "x$ENABLED_FWD" = "xyes"])
AM_CONDITIONAL([BUILD_TERM],[test "x$ENABLED_TERM" = "xyes"])
AM_CONDITIONAL([BUILD_SHELL],[test "x$ENABLED_SHELL" = "xyes"])
AM_CONDITIONAL([BUILD_AGENT],[test "x$ENABLED_AGENT" = "xyes"])
AM_CONDITIONAL([BUILD_SSHD],[test "x$ENABLED_SSHD" = "xyes"])
AM_CONDITIONAL([BUILD_SSHCLIENT],[test "x$ENABLED_SSHCLIENT" = "xyes"])
AM_CONDITIONAL([BUILD_CERTS],[test "x$ENABLED_CERTS" = "xyes"])
AM_CONDITIONAL([BUILD_TPM],[test "x$ENABLED_TPM" = "xyes"])
AM_CONDITIONAL([BUILD_KEYBOARD_INTERACTIVE],[test "x$ENABLED_KEYBOARD_INTERACTIVE" = "xyes"])

AX_HARDEN_CC_COMPILER_FLAGS

dnl A test that is configured out compiles down to "return 77", the automake
dnl skip code, and so does the main() that forwards to it. Apple's linker folds
dnl the two identical bodies together, then writes LC_MAIN entryoff 0, so the
dnl binary starts executing at the Mach-O header and dies with SIGILL instead
dnl of skipping. Turn the folding off where the linker understands the flag;
dnl GNU ld rejects it and is unaffected.
AX_CHECK_LINK_FLAG([-Wl,-no_deduplicate],
                   [AM_LDFLAGS="$AM_LDFLAGS -Wl,-no_deduplicate"])

AS_IF([test -n "$WINCERT_LIBS"],[LIBS="$LIBS $WINCERT_LIBS"])

CREATE_HEX_VERSION
AC_SUBST([AM_CPPFLAGS])
AC_SUBST([AM_CFLAGS])
AC_SUBST([AM_LDFLAGS])

# Tools used by the SBOM targets (see Makefile.am `make sbom`).  GIT is used
# only to derive SOURCE_DATE_EPOCH for reproducible SBOM output; all three are
# optional and the target reports a clear error when a required one is missing.
AC_PATH_PROG([PYTHON3], [python3])
AC_PATH_PROG([PYSPDXTOOLS], [pyspdxtools])
AC_PATH_PROG([GIT], [git])

# FINAL
AC_CONFIG_FILES([Makefile wolfssh/version.h])

AX_CREATE_GENERIC_CONFIG

AC_OUTPUT

# force make clean
AS_ECHO(["---"])
AS_ECHO(["Running make clean..."])
make clean >/dev/null 2>&1

# output config summary
AS_ECHO(["---"])
AS_ECHO(["Configuration summary for $PACKAGE_NAME version $VERSION"])
AS_ECHO
AS_ECHO(["   * Installation prefix:       $prefix"])
AS_ECHO(["   * System type:               $host_vendor-$host_os"])
AS_ECHO(["   * Host CPU:                  $host_cpu"])
AS_ECHO(["   * C Compiler:                $CC"])
AS_ECHO(["   * C Flags:                   $CFLAGS"])
AS_ECHO(["   * CPP Flags:                 $CPPFLAGS"])
AS_ECHO(["   * Linker Flags:              $LDFLAGS"])
AS_ECHO
AS_ECHO(["   Features"])
AS_ECHO(["   * Inline Code:               $ENABLED_INLINE"])
AS_ECHO(["   * Small stack:               $ENABLED_SMALLSTACK"])
AS_ECHO(["   * keygen:                    $ENABLED_KEYGEN"])
AS_ECHO(["   * keyboard interactive:      $ENABLED_KEYBOARD_INTERACTIVE"])
AS_ECHO(["   * psuedo-terminal:           $ENABLED_TERM"])
AS_ECHO(["   * echoserver shell support:  $ENABLED_SHELL"])
AS_ECHO(["   * scp:                       $ENABLED_SCP"])
AS_ECHO(["   * sftp:                      $ENABLED_SFTP"])
AS_ECHO(["   * sftp buffer zeroize:       $ENABLED_SFTP_ZEROIZE"])
AS_ECHO(["   * allow none cipher/MAC:     $ENABLED_NONE_CIPHER"])
AS_ECHO(["   * sshd:                      $ENABLED_SSHD"])
AS_ECHO(["   * ssh client:                $ENABLED_SSHCLIENT"])
AS_ECHO(["   * agent:                     $ENABLED_AGENT"])
AS_ECHO(["   * TPM 2.0 support:           $ENABLED_TPM"])
AS_ECHO(["   * TCP/IP Forwarding:         $ENABLED_FWD"])
AS_ECHO(["   * X.509 Certs:               $ENABLED_CERTS"])
AS_ECHO(["   * OpenSSH Certs:             $ENABLED_OSSH_CERTS"])
AS_ECHO(["   * Windows cert store:        $ENABLED_WINDOWS_CERT_STORE"])
AS_ECHO(["   * Examples:                  $ENABLED_EXAMPLES"])