1 dnl Find the compiler and linker flags for Kerberos.
3 dnl Finds the compiler and linker flags for linking with Kerberos libraries.
4 dnl Provides the --with-krb5, --with-krb5-include, and --with-krb5-lib
5 dnl configure options to specify non-standard paths to the Kerberos libraries.
6 dnl Uses krb5-config where available unless reduced dependencies is requested
7 dnl or --with-krb5-include or --with-krb5-lib are given.
9 dnl Provides the macro RRA_LIB_KRB5 and sets the substitution variables
10 dnl KRB5_CPPFLAGS, KRB5_LDFLAGS, and KRB5_LIBS. Also provides
11 dnl RRA_LIB_KRB5_SWITCH to set CPPFLAGS, LDFLAGS, and LIBS to include the
12 dnl Kerberos libraries, saving the current values first, and
13 dnl RRA_LIB_KRB5_RESTORE to restore those settings to before the last
14 dnl RRA_LIB_KRB5_SWITCH. HAVE_KRB5 will always be defined if RRA_LIB_KRB5 is
17 dnl If KRB5_CPPFLAGS, KRB5_LDFLAGS, or KRB5_LIBS are set before calling these
18 dnl macros, their values will be added to whatever the macros discover.
20 dnl KRB5_CPPFLAGS_GCC will be set to the same value as KRB5_CPPFLAGS but with
21 dnl any occurrences of -I changed to -isystem. This may be useful to suppress
22 dnl warnings from the Kerberos header files when building with GCC and
23 dnl aggressive warning flags. Be aware that this change will change the
24 dnl compiler header file search order as well.
26 dnl Provides the RRA_LIB_KRB5_OPTIONAL macro, which should be used if Kerberos
27 dnl support is optional. In this case, Kerberos libraries are mandatory if
28 dnl --with-krb5 is given, and will not be probed for if --without-krb5 is
29 dnl given. Otherwise, they'll be probed for but will not be required.
30 dnl Defines HAVE_KRB5 and sets rra_use_KRB5 to true if the libraries are
31 dnl found. The substitution variables will always be set, but they will be
32 dnl empty unless Kerberos libraries are found and the user did not disable
35 dnl Sets the Automake conditional KRB5_USES_COM_ERR saying whether we use
36 dnl com_err, since if we're also linking with AFS libraries, we may have to
37 dnl change library ordering in that case.
39 dnl Depends on RRA_KRB5_CONFIG, RRA_ENABLE_REDUCED_DEPENDS, and
42 dnl Also provides RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_FREE_ARGS, which checks
43 dnl whether krb5_get_init_creds_opt_free takes one argument or two. Defines
44 dnl HAVE_KRB5_GET_INIT_CREDS_OPT_FREE_2_ARGS if it takes two arguments.
46 dnl Also provides RRA_INCLUDES_KRB5, which are the headers to include when
47 dnl probing the Kerberos library properties.
49 dnl The canonical version of this file is maintained in the rra-c-util
50 dnl package, available at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
52 dnl Written by Russ Allbery <eagle@eyrie.org>
53 dnl Copyright 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2013, 2014
54 dnl The Board of Trustees of the Leland Stanford Junior University
56 dnl This file is free software; the authors give unlimited permission to copy
57 dnl and/or distribute it, with or without modifications, as long as this
58 dnl notice is preserved.
60 dnl Ignore Automake conditionals if not using Automake.
61 m4_define_default([AM_CONDITIONAL], [:])
63 dnl Headers to include when probing for Kerberos library properties.
64 AC_DEFUN([RRA_INCLUDES_KRB5], [[
67 #elif HAVE_KERBEROSV5_KRB5_H
68 # include <kerberosv5/krb5.h>
70 # include <krb5/krb5.h>
74 dnl Save the current CPPFLAGS, LDFLAGS, and LIBS settings and switch to
75 dnl versions that include the Kerberos flags. Used as a wrapper, with
76 dnl RRA_LIB_KRB5_RESTORE, around tests.
77 AC_DEFUN([RRA_LIB_KRB5_SWITCH],
78 [rra_krb5_save_CPPFLAGS="$CPPFLAGS"
79 rra_krb5_save_LDFLAGS="$LDFLAGS"
80 rra_krb5_save_LIBS="$LIBS"
81 CPPFLAGS="$KRB5_CPPFLAGS $CPPFLAGS"
82 LDFLAGS="$KRB5_LDFLAGS $LDFLAGS"
83 LIBS="$KRB5_LIBS $LIBS"])
85 dnl Restore CPPFLAGS, LDFLAGS, and LIBS to their previous values (before
86 dnl RRA_LIB_KRB5_SWITCH was called).
87 AC_DEFUN([RRA_LIB_KRB5_RESTORE],
88 [CPPFLAGS="$rra_krb5_save_CPPFLAGS"
89 LDFLAGS="$rra_krb5_save_LDFLAGS"
90 LIBS="$rra_krb5_save_LIBS"])
92 dnl Set KRB5_CPPFLAGS and KRB5_LDFLAGS based on rra_krb5_root,
93 dnl rra_krb5_libdir, and rra_krb5_includedir.
94 AC_DEFUN([_RRA_LIB_KRB5_PATHS],
95 [AS_IF([test x"$rra_krb5_libdir" != x],
96 [KRB5_LDFLAGS="-L$rra_krb5_libdir"],
97 [AS_IF([test x"$rra_krb5_root" != x],
98 [RRA_SET_LDFLAGS([KRB5_LDFLAGS], [$rra_krb5_root])])])
99 AS_IF([test x"$rra_krb5_includedir" != x],
100 [KRB5_CPPFLAGS="-I$rra_krb5_includedir"],
101 [AS_IF([test x"$rra_krb5_root" != x],
102 [AS_IF([test x"$rra_krb5_root" != x/usr],
103 [KRB5_CPPFLAGS="-I${rra_krb5_root}/include"])])])])
105 dnl Check for a header using a file existence check rather than using
106 dnl AC_CHECK_HEADERS. This is used if there were arguments to configure
107 dnl specifying the Kerberos header path, since we may have one header in the
108 dnl default include path and another under our explicitly-configured Kerberos
110 AC_DEFUN([_RRA_LIB_KRB5_CHECK_HEADER],
111 [AC_MSG_CHECKING([for $1])
112 AS_IF([test -f "${rra_krb5_incroot}/$1"],
113 [AC_DEFINE_UNQUOTED(AS_TR_CPP([HAVE_$1]), [1],
114 [Define to 1 if you have the <$1> header file.])
115 AC_MSG_RESULT([yes])],
116 [AC_MSG_RESULT([no])])])
118 dnl Check for the com_err header. Internal helper macro since we need
119 dnl to do the same checks in multiple places.
120 AC_DEFUN([_RRA_LIB_KRB5_CHECK_HEADER_COM_ERR],
121 [AS_IF([test x"$rra_krb5_incroot" = x],
122 [AC_CHECK_HEADERS([et/com_err.h kerberosv5/com_err.h])],
123 [_RRA_LIB_KRB5_CHECK_HEADER([et/com_err.h])
124 _RRA_LIB_KRB5_CHECK_HEADER([kerberosv5/com_err.h])])])
126 dnl Check for the main Kerberos header. Internal helper macro since we need
127 dnl to do the same checks in multiple places.
128 AC_DEFUN([_RRA_LIB_KRB5_CHECK_HEADER_KRB5],
129 [AS_IF([test x"$rra_krb5_incroot" = x],
130 [AC_CHECK_HEADERS([krb5.h kerberosv5/krb5.h krb5/krb5.h])],
131 [_RRA_LIB_KRB5_CHECK_HEADER([krb5.h])
132 _RRA_LIB_KRB5_CHECK_HEADER([kerberosv5/krb5.h])
133 _RRA_LIB_KRB5_CHECK_HEADER([krb5/krb5.h])])])
135 dnl Does the appropriate library checks for reduced-dependency Kerberos
136 dnl linkage. The single argument, if true, says to fail if Kerberos could not
138 AC_DEFUN([_RRA_LIB_KRB5_REDUCED],
140 AC_CHECK_LIB([krb5], [krb5_init_context], [KRB5_LIBS="-lkrb5"],
141 [AS_IF([test x"$1" = xtrue],
142 [AC_MSG_ERROR([cannot find usable Kerberos library])])])
143 LIBS="$KRB5_LIBS $LIBS"
144 _RRA_LIB_KRB5_CHECK_HEADER_KRB5
145 AC_CHECK_FUNCS([krb5_get_error_message],
146 [AC_CHECK_FUNCS([krb5_free_error_message])],
147 [AC_CHECK_FUNCS([krb5_get_error_string], [],
148 [AC_CHECK_FUNCS([krb5_get_err_txt], [],
149 [AC_CHECK_LIB([ksvc], [krb5_svc_get_msg],
150 [KRB5_LIBS="$KRB5_LIBS -lksvc"
151 AC_DEFINE([HAVE_KRB5_SVC_GET_MSG], [1])
152 AC_CHECK_HEADERS([ibm_svc/krb5_svc.h], [], [],
153 [RRA_INCLUDES_KRB5])],
154 [AC_CHECK_LIB([com_err], [com_err],
155 [KRB5_LIBS="$KRB5_LIBS -lcom_err"],
156 [AS_IF([test x"$1" = xtrue],
157 [AC_MSG_ERROR([cannot find usable com_err library])],
159 _RRA_LIB_KRB5_CHECK_HEADER_COM_ERR])])])])
160 RRA_LIB_KRB5_RESTORE])
162 dnl Does the appropriate library checks for Kerberos linkage when we don't
163 dnl have krb5-config or reduced dependencies. The single argument, if true,
164 dnl says to fail if Kerberos could not be found.
165 AC_DEFUN([_RRA_LIB_KRB5_MANUAL],
169 AC_SEARCH_LIBS([res_search], [resolv], [],
170 [AC_SEARCH_LIBS([__res_search], [resolv])])
171 AC_SEARCH_LIBS([gethostbyname], [nsl])
172 AC_SEARCH_LIBS([socket], [socket], [],
173 [AC_CHECK_LIB([nsl], [socket], [LIBS="-lnsl -lsocket $LIBS"], [],
175 AC_SEARCH_LIBS([crypt], [crypt])
176 AC_SEARCH_LIBS([roken_concat], [roken])
177 rra_krb5_extra="$LIBS"
178 LIBS="$rra_krb5_save_LIBS"
179 AC_CHECK_LIB([krb5], [krb5_init_context],
180 [KRB5_LIBS="-lkrb5 -lasn1 -lcom_err -lcrypto $rra_krb5_extra"],
181 [AC_CHECK_LIB([krb5support], [krb5int_getspecific],
182 [rra_krb5_extra="-lkrb5support $rra_krb5_extra"],
183 [AC_CHECK_LIB([pthreads], [pthread_setspecific],
184 [rra_krb5_pthread="-lpthreads"],
185 [AC_CHECK_LIB([pthread], [pthread_setspecific],
186 [rra_krb5_pthread="-lpthread"])])
187 AC_CHECK_LIB([krb5support], [krb5int_setspecific],
188 [rra_krb5_extra="-lkrb5support $rra_krb5_extra $rra_krb5_pthread"],
189 [], [$rra_krb5_pthread $rra_krb5_extra])],
191 AC_CHECK_LIB([com_err], [error_message],
192 [rra_krb5_extra="-lcom_err $rra_krb5_extra"], [], [$rra_krb5_extra])
193 AC_CHECK_LIB([ksvc], [krb5_svc_get_msg],
194 [rra_krb5_extra="-lksvc $rra_krb5_extra"], [], [$rra_krb5_extra])
195 AC_CHECK_LIB([k5crypto], [krb5int_hash_md5],
196 [rra_krb5_extra="-lk5crypto $rra_krb5_extra"], [], [$rra_krb5_extra])
197 AC_CHECK_LIB([k5profile], [profile_get_values],
198 [rra_krb5_extra="-lk5profile $rra_krb5_extra"], [], [$rra_krb5_extra])
199 AC_CHECK_LIB([krb5], [krb5_cc_default],
200 [KRB5_LIBS="-lkrb5 $rra_krb5_extra"],
201 [AS_IF([test x"$1" = xtrue],
202 [AC_MSG_ERROR([cannot find usable Kerberos library])])],
204 [-lasn1 -lcom_err -lcrypto $rra_krb5_extra])
205 LIBS="$KRB5_LIBS $LIBS"
206 _RRA_LIB_KRB5_CHECK_HEADER_KRB5
207 AC_CHECK_FUNCS([krb5_get_error_message],
208 [AC_CHECK_FUNCS([krb5_free_error_message])],
209 [AC_CHECK_FUNCS([krb5_get_error_string], [],
210 [AC_CHECK_FUNCS([krb5_get_err_txt], [],
211 [AC_CHECK_FUNCS([krb5_svc_get_msg],
212 [AC_CHECK_HEADERS([ibm_svc/krb5_svc.h], [], [],
213 [RRA_INCLUDES_KRB5])],
214 [_RRA_LIB_KRB5_CHECK_HEADER_COM_ERR])])])])
215 RRA_LIB_KRB5_RESTORE])
217 dnl Sanity-check the results of krb5-config and be sure we can really link a
218 dnl Kerberos program. If that fails, clear KRB5_CPPFLAGS and KRB5_LIBS so
219 dnl that we know we don't have usable flags and fall back on the manual
221 AC_DEFUN([_RRA_LIB_KRB5_CHECK],
223 AC_CHECK_FUNC([krb5_init_context],
224 [RRA_LIB_KRB5_RESTORE],
225 [RRA_LIB_KRB5_RESTORE
229 _RRA_LIB_KRB5_MANUAL([$1])])])
231 dnl Determine Kerberos compiler and linker flags from krb5-config. Does the
232 dnl additional probing we need to do to uncover error handling features, and
233 dnl falls back on the manual checks.
234 AC_DEFUN([_RRA_LIB_KRB5_CONFIG],
235 [RRA_KRB5_CONFIG([${rra_krb5_root}], [krb5], [KRB5],
236 [_RRA_LIB_KRB5_CHECK([$1])
238 _RRA_LIB_KRB5_CHECK_HEADER_KRB5
239 AC_CHECK_FUNCS([krb5_get_error_message],
240 [AC_CHECK_FUNCS([krb5_free_error_message])],
241 [AC_CHECK_FUNCS([krb5_get_error_string], [],
242 [AC_CHECK_FUNCS([krb5_get_err_txt], [],
243 [AC_CHECK_FUNCS([krb5_svc_get_msg],
244 [AC_CHECK_HEADERS([ibm_svc/krb5_svc.h], [], [],
245 [RRA_INCLUDES_KRB5])],
246 [_RRA_LIB_KRB5_CHECK_HEADER_COM_ERR])])])])
247 RRA_LIB_KRB5_RESTORE],
249 _RRA_LIB_KRB5_MANUAL([$1])])])
251 dnl The core of the library checking, shared between RRA_LIB_KRB5 and
252 dnl RRA_LIB_KRB5_OPTIONAL. The single argument, if "true", says to fail if
253 dnl Kerberos could not be found. Set up rra_krb5_incroot for later header
255 AC_DEFUN([_RRA_LIB_KRB5_INTERNAL],
256 [AC_REQUIRE([RRA_ENABLE_REDUCED_DEPENDS])
258 AC_SUBST([KRB5_CPPFLAGS])
259 AC_SUBST([KRB5_CPPFLAGS_GCC])
260 AC_SUBST([KRB5_LDFLAGS])
261 AC_SUBST([KRB5_LIBS])
262 AS_IF([test x"$rra_krb5_includedir" != x],
263 [rra_krb5_incroot="$rra_krb5_includedir"],
264 [AS_IF([test x"$rra_krb5_root" != x],
265 [rra_krb5_incroot="${rra_krb5_root}/include"])])
266 AS_IF([test x"$rra_reduced_depends" = xtrue],
268 _RRA_LIB_KRB5_REDUCED([$1])],
269 [AS_IF([test x"$rra_krb5_includedir" = x && test x"$rra_krb5_libdir" = x],
270 [_RRA_LIB_KRB5_CONFIG([$1])],
272 _RRA_LIB_KRB5_MANUAL([$1])])])
273 rra_krb5_uses_com_err=false
274 AS_CASE([$KRB5_LIBS], [*-lcom_err*], [rra_krb5_uses_com_err=true])
275 AM_CONDITIONAL([KRB5_USES_COM_ERR],
276 [test x"$rra_krb5_uses_com_err" = xtrue])
277 KRB5_CPPFLAGS_GCC=`echo "$KRB5_CPPFLAGS" | sed -e 's/-I/-isystem /g'`])
279 dnl The main macro for packages with mandatory Kerberos support.
280 AC_DEFUN([RRA_LIB_KRB5],
287 [AS_HELP_STRING([--with-krb5=DIR],
288 [Location of Kerberos headers and libraries])],
289 [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
290 [rra_krb5_root="$withval"])])
291 AC_ARG_WITH([krb5-include],
292 [AS_HELP_STRING([--with-krb5-include=DIR],
293 [Location of Kerberos headers])],
294 [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
295 [rra_krb5_includedir="$withval"])])
296 AC_ARG_WITH([krb5-lib],
297 [AS_HELP_STRING([--with-krb5-lib=DIR],
298 [Location of Kerberos libraries])],
299 [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
300 [rra_krb5_libdir="$withval"])])
301 _RRA_LIB_KRB5_INTERNAL([true])
302 AC_DEFINE([HAVE_KRB5], 1, [Define to enable Kerberos features.])])
304 dnl The main macro for packages with optional Kerberos support.
305 AC_DEFUN([RRA_LIB_KRB5_OPTIONAL],
312 [AS_HELP_STRING([--with-krb5@<:@=DIR@:>@],
313 [Location of Kerberos headers and libraries])],
314 [AS_IF([test x"$withval" = xno],
315 [rra_use_KRB5=false],
316 [AS_IF([test x"$withval" != xyes], [rra_krb5_root="$withval"])
317 rra_use_KRB5=true])])
318 AC_ARG_WITH([krb5-include],
319 [AS_HELP_STRING([--with-krb5-include=DIR],
320 [Location of Kerberos headers])],
321 [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
322 [rra_krb5_includedir="$withval"])])
323 AC_ARG_WITH([krb5-lib],
324 [AS_HELP_STRING([--with-krb5-lib=DIR],
325 [Location of Kerberos libraries])],
326 [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
327 [rra_krb5_libdir="$withval"])])
329 AS_IF([test x"$rra_use_KRB5" != xfalse],
330 [AS_IF([test x"$rra_use_KRB5" = xtrue],
331 [_RRA_LIB_KRB5_INTERNAL([true])],
332 [_RRA_LIB_KRB5_INTERNAL([false])])],
333 [AM_CONDITIONAL([KRB5_USES_COM_ERR], [false])])
334 AS_IF([test x"$KRB5_LIBS" != x],
336 AC_DEFINE([HAVE_KRB5], 1, [Define to enable Kerberos features.])])])
338 dnl Source used by RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_FREE_ARGS.
339 AC_DEFUN([_RRA_FUNC_KRB5_OPT_FREE_ARGS_SOURCE], [RRA_INCLUDES_KRB5] [[
343 krb5_get_init_creds_opt *opts;
345 krb5_get_init_creds_opt_free(c, opts);
349 dnl Check whether krb5_get_init_creds_opt_free takes one argument or two.
350 dnl Early Heimdal used to take a single argument. Defines
351 dnl HAVE_KRB5_GET_INIT_CREDS_OPT_FREE_2_ARGS if it takes two arguments.
353 dnl Should be called with RRA_LIB_KRB5_SWITCH active.
354 AC_DEFUN([RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_FREE_ARGS],
355 [AC_CACHE_CHECK([if krb5_get_init_creds_opt_free takes two arguments],
356 [rra_cv_func_krb5_get_init_creds_opt_free_args],
357 [AC_COMPILE_IFELSE([AC_LANG_SOURCE([_RRA_FUNC_KRB5_OPT_FREE_ARGS_SOURCE])],
358 [rra_cv_func_krb5_get_init_creds_opt_free_args=yes],
359 [rra_cv_func_krb5_get_init_creds_opt_free_args=no])])
360 AS_IF([test $rra_cv_func_krb5_get_init_creds_opt_free_args = yes],
361 [AC_DEFINE([HAVE_KRB5_GET_INIT_CREDS_OPT_FREE_2_ARGS], 1,
362 [Define if krb5_get_init_creds_opt_free takes two arguments.])])])