m4/krb5.m4

   1 dnl Find the compiler and linker flags for Kerberos.
   2 dnl
   3 dnl Finds the compiler and linker flags for linking with Kerberos libraries.
   4 dnl Provides the --with-krb5, --with-krb5-include, and --with-krb5-lib
   5 dnl configure options to specify non-standard paths to the Kerberos libraries.
   6 dnl Uses krb5-config where available unless reduced dependencies is requested
   7 dnl or --with-krb5-include or --with-krb5-lib are given.
   8 dnl
   9 dnl Provides the macro RRA_LIB_KRB5 and sets the substitution variables
  10 dnl KRB5_CPPFLAGS, KRB5_LDFLAGS, and KRB5_LIBS.  Also provides
  11 dnl RRA_LIB_KRB5_SWITCH to set CPPFLAGS, LDFLAGS, and LIBS to include the
  12 dnl Kerberos libraries, saving the current values first, and
  13 dnl RRA_LIB_KRB5_RESTORE to restore those settings to before the last
  14 dnl RRA_LIB_KRB5_SWITCH.  HAVE_KRB5 will always be defined if RRA_LIB_KRB5 is
  15 dnl used.
  16 dnl
  17 dnl If KRB5_CPPFLAGS, KRB5_LDFLAGS, or KRB5_LIBS are set before calling these
  18 dnl macros, their values will be added to whatever the macros discover.
  19 dnl
  20 dnl KRB5_CPPFLAGS_GCC will be set to the same value as KRB5_CPPFLAGS but with
  21 dnl any occurrences of -I changed to -isystem.  This may be useful to suppress
  22 dnl warnings from the Kerberos header files when building with GCC and
  23 dnl aggressive warning flags.  Be aware that this change will change the
  24 dnl compiler header file search order as well.
  25 dnl
  26 dnl Provides the RRA_LIB_KRB5_OPTIONAL macro, which should be used if Kerberos
  27 dnl support is optional.  In this case, Kerberos libraries are mandatory if
  28 dnl --with-krb5 is given, and will not be probed for if --without-krb5 is
  29 dnl given.  Otherwise, they'll be probed for but will not be required.
  30 dnl Defines HAVE_KRB5 and sets rra_use_KRB5 to true if the libraries are
  31 dnl found.  The substitution variables will always be set, but they will be
  32 dnl empty unless Kerberos libraries are found and the user did not disable
  33 dnl Kerberos support.
  34 dnl
  35 dnl Sets the Automake conditional KRB5_USES_COM_ERR saying whether we use
  36 dnl com_err, since if we're also linking with AFS libraries, we may have to
  37 dnl change library ordering in that case.
  38 dnl
  39 dnl Depends on RRA_KRB5_CONFIG, RRA_ENABLE_REDUCED_DEPENDS, and
  40 dnl RRA_SET_LDFLAGS.
  41 dnl
  42 dnl Also provides RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_FREE_ARGS, which checks
  43 dnl whether krb5_get_init_creds_opt_free takes one argument or two.  Defines
  44 dnl HAVE_KRB5_GET_INIT_CREDS_OPT_FREE_2_ARGS if it takes two arguments.
  45 dnl
  46 dnl Also provides RRA_INCLUDES_KRB5, which are the headers to include when
  47 dnl probing the Kerberos library properties.
  48 dnl
  49 dnl The canonical version of this file is maintained in the rra-c-util
  50 dnl package, available at <https://www.eyrie.org/~eagle/software/rra-c-util/>.
  51 dnl
  52 dnl Written by Russ Allbery <eagle@eyrie.org>
  53 dnl Copyright 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2013, 2014
  54 dnl     The Board of Trustees of the Leland Stanford Junior University
  55 dnl
  56 dnl This file is free software; the authors give unlimited permission to copy
  57 dnl and/or distribute it, with or without modifications, as long as this
  58 dnl notice is preserved.
  59
  60 dnl Ignore Automake conditionals if not using Automake.
  61 m4_define_default([AM_CONDITIONAL], [:])
  62
  63 dnl Headers to include when probing for Kerberos library properties.
  64 AC_DEFUN([RRA_INCLUDES_KRB5], [[
  65 #if HAVE_KRB5_H
  66 # include <krb5.h>
  67 #elif HAVE_KERBEROSV5_KRB5_H
  68 # include <kerberosv5/krb5.h>
  69 #else
  70 # include <krb5/krb5.h>
  71 #endif
  72 ]])
  73
  74 dnl Save the current CPPFLAGS, LDFLAGS, and LIBS settings and switch to
  75 dnl versions that include the Kerberos flags.  Used as a wrapper, with
  76 dnl RRA_LIB_KRB5_RESTORE, around tests.
  77 AC_DEFUN([RRA_LIB_KRB5_SWITCH],
  78 [rra_krb5_save_CPPFLAGS="$CPPFLAGS"
  79  rra_krb5_save_LDFLAGS="$LDFLAGS"
  80  rra_krb5_save_LIBS="$LIBS"
  81  CPPFLAGS="$KRB5_CPPFLAGS $CPPFLAGS"
  82  LDFLAGS="$KRB5_LDFLAGS $LDFLAGS"
  83  LIBS="$KRB5_LIBS $LIBS"])
  84
  85 dnl Restore CPPFLAGS, LDFLAGS, and LIBS to their previous values (before
  86 dnl RRA_LIB_KRB5_SWITCH was called).
  87 AC_DEFUN([RRA_LIB_KRB5_RESTORE],
  88 [CPPFLAGS="$rra_krb5_save_CPPFLAGS"
  89  LDFLAGS="$rra_krb5_save_LDFLAGS"
  90  LIBS="$rra_krb5_save_LIBS"])
  91
  92 dnl Set KRB5_CPPFLAGS and KRB5_LDFLAGS based on rra_krb5_root,
  93 dnl rra_krb5_libdir, and rra_krb5_includedir.
  94 AC_DEFUN([_RRA_LIB_KRB5_PATHS],
  95 [AS_IF([test x"$rra_krb5_libdir" != x],
  96     [KRB5_LDFLAGS="-L$rra_krb5_libdir"],
  97     [AS_IF([test x"$rra_krb5_root" != x],
  98         [RRA_SET_LDFLAGS([KRB5_LDFLAGS], [$rra_krb5_root])])])
  99  AS_IF([test x"$rra_krb5_includedir" != x],
 100     [KRB5_CPPFLAGS="-I$rra_krb5_includedir"],
 101     [AS_IF([test x"$rra_krb5_root" != x],
 102         [AS_IF([test x"$rra_krb5_root" != x/usr],
 103             [KRB5_CPPFLAGS="-I${rra_krb5_root}/include"])])])])
 104
 105 dnl Check for a header using a file existence check rather than using
 106 dnl AC_CHECK_HEADERS.  This is used if there were arguments to configure
 107 dnl specifying the Kerberos header path, since we may have one header in the
 108 dnl default include path and another under our explicitly-configured Kerberos
 109 dnl location.
 110 AC_DEFUN([_RRA_LIB_KRB5_CHECK_HEADER],
 111 [AC_MSG_CHECKING([for $1])
 112  AS_IF([test -f "${rra_krb5_incroot}/$1"],
 113     [AC_DEFINE_UNQUOTED(AS_TR_CPP([HAVE_$1]), [1],
 114         [Define to 1 if you have the <$1> header file.])
 115      AC_MSG_RESULT([yes])],
 116     [AC_MSG_RESULT([no])])])
 117
 118 dnl Check for the com_err header.  Internal helper macro since we need
 119 dnl to do the same checks in multiple places.
 120 AC_DEFUN([_RRA_LIB_KRB5_CHECK_HEADER_COM_ERR],
 121 [AS_IF([test x"$rra_krb5_incroot" = x],
 122     [AC_CHECK_HEADERS([et/com_err.h kerberosv5/com_err.h])],
 123         [_RRA_LIB_KRB5_CHECK_HEADER([et/com_err.h])
 124          _RRA_LIB_KRB5_CHECK_HEADER([kerberosv5/com_err.h])])])
 125
 126 dnl Check for the main Kerberos header.  Internal helper macro since we need
 127 dnl to do the same checks in multiple places.
 128 AC_DEFUN([_RRA_LIB_KRB5_CHECK_HEADER_KRB5],
 129 [AS_IF([test x"$rra_krb5_incroot" = x],
 130      [AC_CHECK_HEADERS([krb5.h kerberosv5/krb5.h krb5/krb5.h])],
 131      [_RRA_LIB_KRB5_CHECK_HEADER([krb5.h])
 132       _RRA_LIB_KRB5_CHECK_HEADER([kerberosv5/krb5.h])
 133       _RRA_LIB_KRB5_CHECK_HEADER([krb5/krb5.h])])])
 134
 135 dnl Does the appropriate library checks for reduced-dependency Kerberos
 136 dnl linkage.  The single argument, if true, says to fail if Kerberos could not
 137 dnl be found.
 138 AC_DEFUN([_RRA_LIB_KRB5_REDUCED],
 139 [RRA_LIB_KRB5_SWITCH
 140  AC_CHECK_LIB([krb5], [krb5_init_context], [KRB5_LIBS="-lkrb5"],
 141      [AS_IF([test x"$1" = xtrue],
 142          [AC_MSG_ERROR([cannot find usable Kerberos library])])])
 143  LIBS="$KRB5_LIBS $LIBS"
 144  _RRA_LIB_KRB5_CHECK_HEADER_KRB5
 145  AC_CHECK_FUNCS([krb5_get_error_message],
 146      [AC_CHECK_FUNCS([krb5_free_error_message])],
 147      [AC_CHECK_FUNCS([krb5_get_error_string], [],
 148          [AC_CHECK_FUNCS([krb5_get_err_txt], [],
 149              [AC_CHECK_LIB([ksvc], [krb5_svc_get_msg],
 150                  [KRB5_LIBS="$KRB5_LIBS -lksvc"
 151                   AC_DEFINE([HAVE_KRB5_SVC_GET_MSG], [1])
 152                   AC_CHECK_HEADERS([ibm_svc/krb5_svc.h], [], [],
 153                      [RRA_INCLUDES_KRB5])],
 154                  [AC_CHECK_LIB([com_err], [com_err],
 155                      [KRB5_LIBS="$KRB5_LIBS -lcom_err"],
 156                      [AS_IF([test x"$1" = xtrue],
 157                          [AC_MSG_ERROR([cannot find usable com_err library])],
 158                          [KRB5_LIBS=""])])
 159                   _RRA_LIB_KRB5_CHECK_HEADER_COM_ERR])])])])
 160  RRA_LIB_KRB5_RESTORE])
 161
 162 dnl Does the appropriate library checks for Kerberos linkage when we don't
 163 dnl have krb5-config or reduced dependencies.  The single argument, if true,
 164 dnl says to fail if Kerberos could not be found.
 165 AC_DEFUN([_RRA_LIB_KRB5_MANUAL],
 166 [RRA_LIB_KRB5_SWITCH
 167  rra_krb5_extra=
 168  LIBS=
 169  AC_SEARCH_LIBS([res_search], [resolv], [],
 170     [AC_SEARCH_LIBS([__res_search], [resolv])])
 171  AC_SEARCH_LIBS([gethostbyname], [nsl])
 172  AC_SEARCH_LIBS([socket], [socket], [],
 173     [AC_CHECK_LIB([nsl], [socket], [LIBS="-lnsl -lsocket $LIBS"], [],
 174         [-lsocket])])
 175  AC_SEARCH_LIBS([crypt], [crypt])
 176  AC_SEARCH_LIBS([roken_concat], [roken])
 177  rra_krb5_extra="$LIBS"
 178  LIBS="$rra_krb5_save_LIBS"
 179  AC_CHECK_LIB([krb5], [krb5_init_context],
 180     [KRB5_LIBS="-lkrb5 -lasn1 -lcom_err -lcrypto $rra_krb5_extra"],
 181     [AC_CHECK_LIB([krb5support], [krb5int_getspecific],
 182         [rra_krb5_extra="-lkrb5support $rra_krb5_extra"],
 183         [AC_CHECK_LIB([pthreads], [pthread_setspecific],
 184             [rra_krb5_pthread="-lpthreads"],
 185             [AC_CHECK_LIB([pthread], [pthread_setspecific],
 186                 [rra_krb5_pthread="-lpthread"])])
 187          AC_CHECK_LIB([krb5support], [krb5int_setspecific],
 188             [rra_krb5_extra="-lkrb5support $rra_krb5_extra $rra_krb5_pthread"],
 189             [], [$rra_krb5_pthread $rra_krb5_extra])],
 190         [$rra_krb5_extra])
 191      AC_CHECK_LIB([com_err], [error_message],
 192         [rra_krb5_extra="-lcom_err $rra_krb5_extra"], [], [$rra_krb5_extra])
 193      AC_CHECK_LIB([ksvc], [krb5_svc_get_msg],
 194         [rra_krb5_extra="-lksvc $rra_krb5_extra"], [], [$rra_krb5_extra])
 195      AC_CHECK_LIB([k5crypto], [krb5int_hash_md5],
 196         [rra_krb5_extra="-lk5crypto $rra_krb5_extra"], [], [$rra_krb5_extra])
 197      AC_CHECK_LIB([k5profile], [profile_get_values],
 198         [rra_krb5_extra="-lk5profile $rra_krb5_extra"], [], [$rra_krb5_extra])
 199      AC_CHECK_LIB([krb5], [krb5_cc_default],
 200         [KRB5_LIBS="-lkrb5 $rra_krb5_extra"],
 201         [AS_IF([test x"$1" = xtrue],
 202             [AC_MSG_ERROR([cannot find usable Kerberos library])])],
 203         [$rra_krb5_extra])],
 204     [-lasn1 -lcom_err -lcrypto $rra_krb5_extra])
 205  LIBS="$KRB5_LIBS $LIBS"
 206  _RRA_LIB_KRB5_CHECK_HEADER_KRB5
 207  AC_CHECK_FUNCS([krb5_get_error_message],
 208      [AC_CHECK_FUNCS([krb5_free_error_message])],
 209      [AC_CHECK_FUNCS([krb5_get_error_string], [],
 210          [AC_CHECK_FUNCS([krb5_get_err_txt], [],
 211              [AC_CHECK_FUNCS([krb5_svc_get_msg],
 212                  [AC_CHECK_HEADERS([ibm_svc/krb5_svc.h], [], [],
 213                      [RRA_INCLUDES_KRB5])],
 214                  [_RRA_LIB_KRB5_CHECK_HEADER_COM_ERR])])])])
 215  RRA_LIB_KRB5_RESTORE])
 216
 217 dnl Sanity-check the results of krb5-config and be sure we can really link a
 218 dnl Kerberos program.  If that fails, clear KRB5_CPPFLAGS and KRB5_LIBS so
 219 dnl that we know we don't have usable flags and fall back on the manual
 220 dnl check.
 221 AC_DEFUN([_RRA_LIB_KRB5_CHECK],
 222 [RRA_LIB_KRB5_SWITCH
 223  AC_CHECK_FUNC([krb5_init_context],
 224     [RRA_LIB_KRB5_RESTORE],
 225     [RRA_LIB_KRB5_RESTORE
 226      KRB5_CPPFLAGS=
 227      KRB5_LIBS=
 228      _RRA_LIB_KRB5_PATHS
 229      _RRA_LIB_KRB5_MANUAL([$1])])])
 230
 231 dnl Determine Kerberos compiler and linker flags from krb5-config.  Does the
 232 dnl additional probing we need to do to uncover error handling features, and
 233 dnl falls back on the manual checks.
 234 AC_DEFUN([_RRA_LIB_KRB5_CONFIG],
 235 [RRA_KRB5_CONFIG([${rra_krb5_root}], [krb5], [KRB5],
 236     [_RRA_LIB_KRB5_CHECK([$1])
 237      RRA_LIB_KRB5_SWITCH
 238      _RRA_LIB_KRB5_CHECK_HEADER_KRB5
 239      AC_CHECK_FUNCS([krb5_get_error_message],
 240          [AC_CHECK_FUNCS([krb5_free_error_message])],
 241          [AC_CHECK_FUNCS([krb5_get_error_string], [],
 242              [AC_CHECK_FUNCS([krb5_get_err_txt], [],
 243                  [AC_CHECK_FUNCS([krb5_svc_get_msg],
 244                      [AC_CHECK_HEADERS([ibm_svc/krb5_svc.h], [], [],
 245                          [RRA_INCLUDES_KRB5])],
 246                      [_RRA_LIB_KRB5_CHECK_HEADER_COM_ERR])])])])
 247      RRA_LIB_KRB5_RESTORE],
 248     [_RRA_LIB_KRB5_PATHS
 249      _RRA_LIB_KRB5_MANUAL([$1])])])
 250
 251 dnl The core of the library checking, shared between RRA_LIB_KRB5 and
 252 dnl RRA_LIB_KRB5_OPTIONAL.  The single argument, if "true", says to fail if
 253 dnl Kerberos could not be found.  Set up rra_krb5_incroot for later header
 254 dnl checking.
 255 AC_DEFUN([_RRA_LIB_KRB5_INTERNAL],
 256 [AC_REQUIRE([RRA_ENABLE_REDUCED_DEPENDS])
 257  rra_krb5_incroot=
 258  AC_SUBST([KRB5_CPPFLAGS])
 259  AC_SUBST([KRB5_CPPFLAGS_GCC])
 260  AC_SUBST([KRB5_LDFLAGS])
 261  AC_SUBST([KRB5_LIBS])
 262  AS_IF([test x"$rra_krb5_includedir" != x],
 263     [rra_krb5_incroot="$rra_krb5_includedir"],
 264     [AS_IF([test x"$rra_krb5_root" != x],
 265         [rra_krb5_incroot="${rra_krb5_root}/include"])])
 266  AS_IF([test x"$rra_reduced_depends" = xtrue],
 267     [_RRA_LIB_KRB5_PATHS
 268      _RRA_LIB_KRB5_REDUCED([$1])],
 269     [AS_IF([test x"$rra_krb5_includedir" = x && test x"$rra_krb5_libdir" = x],
 270         [_RRA_LIB_KRB5_CONFIG([$1])],
 271         [_RRA_LIB_KRB5_PATHS
 272          _RRA_LIB_KRB5_MANUAL([$1])])])
 273  rra_krb5_uses_com_err=false
 274  AS_CASE([$KRB5_LIBS], [*-lcom_err*], [rra_krb5_uses_com_err=true])
 275  AM_CONDITIONAL([KRB5_USES_COM_ERR],
 276     [test x"$rra_krb5_uses_com_err" = xtrue])
 277  KRB5_CPPFLAGS_GCC=`echo "$KRB5_CPPFLAGS" | sed -e 's/-I/-isystem /g'`])
 278
 279 dnl The main macro for packages with mandatory Kerberos support.
 280 AC_DEFUN([RRA_LIB_KRB5],
 281 [rra_krb5_root=
 282  rra_krb5_libdir=
 283  rra_krb5_includedir=
 284  rra_use_KRB5=true
 285
 286  AC_ARG_WITH([krb5],
 287     [AS_HELP_STRING([--with-krb5=DIR],
 288         [Location of Kerberos headers and libraries])],
 289     [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
 290         [rra_krb5_root="$withval"])])
 291  AC_ARG_WITH([krb5-include],
 292     [AS_HELP_STRING([--with-krb5-include=DIR],
 293         [Location of Kerberos headers])],
 294     [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
 295         [rra_krb5_includedir="$withval"])])
 296  AC_ARG_WITH([krb5-lib],
 297     [AS_HELP_STRING([--with-krb5-lib=DIR],
 298         [Location of Kerberos libraries])],
 299     [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
 300         [rra_krb5_libdir="$withval"])])
 301  _RRA_LIB_KRB5_INTERNAL([true])
 302  AC_DEFINE([HAVE_KRB5], 1, [Define to enable Kerberos features.])])
 303
 304 dnl The main macro for packages with optional Kerberos support.
 305 AC_DEFUN([RRA_LIB_KRB5_OPTIONAL],
 306 [rra_krb5_root=
 307  rra_krb5_libdir=
 308  rra_krb5_includedir=
 309  rra_use_KRB5=
 310
 311  AC_ARG_WITH([krb5],
 312     [AS_HELP_STRING([--with-krb5@<:@=DIR@:>@],
 313         [Location of Kerberos headers and libraries])],
 314     [AS_IF([test x"$withval" = xno],
 315         [rra_use_KRB5=false],
 316         [AS_IF([test x"$withval" != xyes], [rra_krb5_root="$withval"])
 317          rra_use_KRB5=true])])
 318  AC_ARG_WITH([krb5-include],
 319     [AS_HELP_STRING([--with-krb5-include=DIR],
 320         [Location of Kerberos headers])],
 321     [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
 322         [rra_krb5_includedir="$withval"])])
 323  AC_ARG_WITH([krb5-lib],
 324     [AS_HELP_STRING([--with-krb5-lib=DIR],
 325         [Location of Kerberos libraries])],
 326     [AS_IF([test x"$withval" != xyes && test x"$withval" != xno],
 327         [rra_krb5_libdir="$withval"])])
 328
 329  AS_IF([test x"$rra_use_KRB5" != xfalse],
 330      [AS_IF([test x"$rra_use_KRB5" = xtrue],
 331          [_RRA_LIB_KRB5_INTERNAL([true])],
 332          [_RRA_LIB_KRB5_INTERNAL([false])])],
 333      [AM_CONDITIONAL([KRB5_USES_COM_ERR], [false])])
 334  AS_IF([test x"$KRB5_LIBS" != x],
 335     [rra_use_KRB5=true
 336      AC_DEFINE([HAVE_KRB5], 1, [Define to enable Kerberos features.])])])
 337
 338 dnl Source used by RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_FREE_ARGS.
 339 AC_DEFUN([_RRA_FUNC_KRB5_OPT_FREE_ARGS_SOURCE], [RRA_INCLUDES_KRB5] [[
 340 int
 341 main(void)
 342 {
 343     krb5_get_init_creds_opt *opts;
 344     krb5_context c;
 345     krb5_get_init_creds_opt_free(c, opts);
 346 }
 347 ]])
 348
 349 dnl Check whether krb5_get_init_creds_opt_free takes one argument or two.
 350 dnl Early Heimdal used to take a single argument.  Defines
 351 dnl HAVE_KRB5_GET_INIT_CREDS_OPT_FREE_2_ARGS if it takes two arguments.
 352 dnl
 353 dnl Should be called with RRA_LIB_KRB5_SWITCH active.
 354 AC_DEFUN([RRA_FUNC_KRB5_GET_INIT_CREDS_OPT_FREE_ARGS],
 355 [AC_CACHE_CHECK([if krb5_get_init_creds_opt_free takes two arguments],
 356     [rra_cv_func_krb5_get_init_creds_opt_free_args],
 357     [AC_COMPILE_IFELSE([AC_LANG_SOURCE([_RRA_FUNC_KRB5_OPT_FREE_ARGS_SOURCE])],
 358         [rra_cv_func_krb5_get_init_creds_opt_free_args=yes],
 359         [rra_cv_func_krb5_get_init_creds_opt_free_args=no])])
 360  AS_IF([test $rra_cv_func_krb5_get_init_creds_opt_free_args = yes],
 361     [AC_DEFINE([HAVE_KRB5_GET_INIT_CREDS_OPT_FREE_2_ARGS], 1,
 362         [Define if krb5_get_init_creds_opt_free takes two arguments.])])])