Enable hardening flags at the end of the configure script.

[tinc] / configure.ac

diff --git a/configure.ac b/configure.ac
index 216f271..4fa9975 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -2,24 +2,22 @@ dnl Process this file with autoconf to produce a configure script.
 
 origcflags="$CFLAGS"
 
 
 origcflags="$CFLAGS"
 

-AC_PREREQ(2.61)
+AC_PREREQ([2.69])

 AC_INIT([tinc], m4_esyscmd_s((git describe || echo UNKNOWN) | sed 's/release-//'))
 AC_CONFIG_SRCDIR([src/tincd.c])
 AC_INIT([tinc], m4_esyscmd_s((git describe || echo UNKNOWN) | sed 's/release-//'))
 AC_CONFIG_SRCDIR([src/tincd.c])

-AM_INIT_AUTOMAKE([std-options subdir-objects nostdinc silent-rules -Wall info-in-builddir])
+AM_INIT_AUTOMAKE([std-options subdir-objects nostdinc silent-rules -Wall])

 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 AM_SILENT_RULES([yes])
 
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 AM_SILENT_RULES([yes])
 

-# Enable GNU extensions.
-# Define this here, not in acconfig's @TOP@ section, since definitions
-# in the latter don't make it into the configure-time tests.
-AC_GNU_SOURCE
-AC_DEFINE([__USE_BSD], 1, [Enable BSD extensions])
+AC_USE_SYSTEM_EXTENSIONS

 
 dnl Checks for programs.
 
 dnl Checks for programs.

+AC_PROG_CC

 AC_PROG_CC_C99
 AC_PROG_CPP
 AC_PROG_INSTALL
 AC_PROG_CC_C99
 AC_PROG_CPP
 AC_PROG_INSTALL

+AC_PROG_LN_S

 AM_PROG_CC_C_O
 
 dnl Check whether to enable code coverage testing, and if so, clear the default CFLAGS.
 AM_PROG_CC_C_O
 
 dnl Check whether to enable code coverage testing, and if so, clear the default CFLAGS.


@@ -65,13 +63,12 @@ case $host_os in
     AC_DEFINE(HAVE_BSD, 1, [Unknown BSD variant])
   ;;
   *cygwin*)
     AC_DEFINE(HAVE_BSD, 1, [Unknown BSD variant])
   ;;
   *cygwin*)

-    cygwin=true
-    AC_DEFINE(HAVE_CYGWIN, 1, [Cygwin])
+    AC_MSG_ERROR("Cygwin is no longer supported. Use MinGW to build native Windows binaries.")

   ;;
   *mingw*)
     mingw=true
     AC_DEFINE(HAVE_MINGW, 1, [MinGW])
   ;;
   *mingw*)
     mingw=true
     AC_DEFINE(HAVE_MINGW, 1, [MinGW])

-    LIBS="$LIBS -lws2_32 -lgdi32 -lcrypt32 -liphlpapi"
+    LIBS="$LIBS -lws2_32 -lgdi32 -lcrypt32 -liphlpapi -lwinpthread"

     LDFLAGS="$LDFLAGS -static"
     CPPFLAGS="$CPPFLAGS -DMINIUPNP_STATICLIB"
   ;;
     LDFLAGS="$LDFLAGS -static"
     CPPFLAGS="$CPPFLAGS -DMINIUPNP_STATICLIB"
   ;;


@@ -94,7 +91,12 @@ AC_ARG_ENABLE(uml,
 AC_ARG_ENABLE(vde,
   AS_HELP_STRING([--enable-vde], [enable support for Virtual Distributed Ethernet]),
   [ AS_IF([test "x$enable_vde" = "xyes"],
 AC_ARG_ENABLE(vde,
   AS_HELP_STRING([--enable-vde], [enable support for Virtual Distributed Ethernet]),
   [ AS_IF([test "x$enable_vde" = "xyes"],

-      [ AC_CHECK_HEADERS(libvdeplug_dyn.h, [], [AC_MSG_ERROR([VDE plug header files not found.]); break])
+      [ AC_CHECK_HEADERS(libvdeplug.h,
+        [AC_CHECK_LIB(vdeplug, vde_close,
+                      [LIBS="$LIBS -lvdeplug"],
+                      [AC_MSG_ERROR("VDE plug library files not found.")]
+        )],
+        [AC_MSG_ERROR([VDE plug header files not found.]); break])

         AC_DEFINE(ENABLE_VDE, 1, [Support for VDE])
         vde=true
       ],
         AC_DEFINE(ENABLE_VDE, 1, [Support for VDE])
         vde=true
       ],


@@ -134,41 +136,17 @@ AM_CONDITIONAL(UML, test "$uml" = true)
 AM_CONDITIONAL(VDE, test "$vde" = true)
 AM_CONDITIONAL(TUNEMU, test "$tunemu" = true)
 AM_CONDITIONAL(WITH_SYSTEMD, test "$systemd" = true)
 AM_CONDITIONAL(VDE, test "$vde" = true)
 AM_CONDITIONAL(TUNEMU, test "$tunemu" = true)
 AM_CONDITIONAL(WITH_SYSTEMD, test "$systemd" = true)

+AM_CONDITIONAL(WITH_LEGACY_PROTOCOL, test "x$enable_legacy_protocol" != "xno")

 
 AC_CACHE_SAVE
 
 AS_IF([test -d /sw/include], [CPPFLAGS="$CPPFLAGS -I/sw/include"])
 AS_IF([test -d /sw/lib], [LIBS="$LIBS -L/sw/lib"])
 
 
 AC_CACHE_SAVE
 
 AS_IF([test -d /sw/include], [CPPFLAGS="$CPPFLAGS -I/sw/include"])
 AS_IF([test -d /sw/lib], [LIBS="$LIBS -L/sw/lib"])
 

-dnl Compiler hardening flags
-dnl No -fstack-protector-all because it doesn't work on all platforms or architectures.
-
-AX_CFLAGS_WARN_ALL(CFLAGS)
-
-AC_ARG_ENABLE([hardening], AS_HELP_STRING([--disable-hardening], [disable compiler and linker hardening flags]))
-AS_IF([test "x$enable_hardening" != "xno"],
-  [AX_CHECK_COMPILE_FLAG([-DFORTIFY_SOURCE=2], [CPPFLAGS="$CPPFLAGS -DFORTIFY_SOURCE=2"])
-   AX_CHECK_COMPILE_FLAG([-fwrapv], [CPPFLAGS="$CPPFLAGS -fwrapv"],
-   AX_CHECK_COMPILE_FLAG([-fno-strict-overflow], [CPPFLAGS="$CPPFLAGS -fno-strict-overflow"]))
-   case $host_os in
-     *mingw*)
-       AX_CHECK_LINK_FLAG([-Wl,--dynamicbase], [LDFLAGS="$LDFLAGS -Wl,--dynamicbase"])
-       AX_CHECK_LINK_FLAG([-Wl,--nxcompat], [LDFLAGS="$LDFLAGS -Wl,--nxcompat"])
-       ;;
-     *)
-       AX_CHECK_COMPILE_FLAG([-fPIE], [CPPFLAGS="$CPPFLAGS -fPIE"])
-       AX_CHECK_LINK_FLAG([-pie], [LDFLAGS="$LDFLAGS -pie"])
-       ;;
-   esac
-   AX_CHECK_LINK_FLAG([-Wl,-z,relro], [LDFLAGS="$LDFLAGS -Wl,-z,relro"])
-   AX_CHECK_LINK_FLAG([-Wl,-z,now], [LDFLAGS="$LDFLAGS -Wl,-z,now"])
-  ]
-);
-

 dnl Checks for header files.
 dnl We do this in multiple stages, because unlike Linux all the other operating systems really suck and don't include their own dependencies.
 
 dnl Checks for header files.
 dnl We do this in multiple stages, because unlike Linux all the other operating systems really suck and don't include their own dependencies.
 

-AC_CHECK_HEADERS([syslog.h sys/file.h sys/ioctl.h sys/mman.h sys/param.h sys/resource.h sys/socket.h sys/time.h sys/un.h sys/wait.h netdb.h arpa/inet.h dirent.h getopt.h])
+AC_CHECK_HEADERS([syslog.h sys/file.h sys/ioctl.h sys/mman.h sys/param.h sys/resource.h sys/socket.h sys/time.h sys/un.h sys/wait.h netdb.h arpa/inet.h dirent.h getopt.h stddef.h sys/epoll.h])

 AC_CHECK_HEADERS([net/if.h net/if_types.h net/ethernet.h net/if_arp.h netinet/in_systm.h netinet/in.h netinet/in6.h netpacket/packet.h],
   [], [], [#include "$srcdir/src/have.h"]
 )
 AC_CHECK_HEADERS([net/if.h net/if_types.h net/ethernet.h net/if_arp.h netinet/in_systm.h netinet/in.h netinet/in6.h netpacket/packet.h],
   [], [], [#include "$srcdir/src/have.h"]
 )


@@ -181,6 +159,7 @@ AC_CHECK_HEADERS([netinet/tcp.h netinet/ip_icmp.h netinet/icmp6.h],
 
 dnl Checks for typedefs, structures, and compiler characteristics.
 tinc_ATTRIBUTE(__malloc__)
 
 dnl Checks for typedefs, structures, and compiler characteristics.
 tinc_ATTRIBUTE(__malloc__)

+tinc_ATTRIBUTE(__nonnull__)

 tinc_ATTRIBUTE(__warn_unused_result__)
 
 AC_CHECK_TYPES([struct ether_header, struct arphdr, struct ether_arp, struct ip, struct icmp, struct ip6_hdr, struct icmp6_hdr, struct nd_neighbor_solicit, struct nd_opt_hdr], , ,
 tinc_ATTRIBUTE(__warn_unused_result__)
 
 AC_CHECK_TYPES([struct ether_header, struct arphdr, struct ether_arp, struct ip, struct icmp, struct ip6_hdr, struct icmp6_hdr, struct nd_neighbor_solicit, struct nd_opt_hdr], , ,


@@ -188,7 +167,6 @@ AC_CHECK_TYPES([struct ether_header, struct arphdr, struct ether_arp, struct ip,
 )
 
 dnl Checks for library functions.
 )
 
 dnl Checks for library functions.

-AC_TYPE_SIGNAL

 AC_CHECK_FUNCS([asprintf daemon fchmod flock fork gettimeofday mlockall putenv recvmmsg strsignal nanosleep unsetenv vsyslog devname fdevname],
   [], [], [#include "$srcdir/src/have.h"]
 )
 AC_CHECK_FUNCS([asprintf daemon fchmod flock fork gettimeofday mlockall putenv recvmmsg strsignal nanosleep unsetenv vsyslog devname fdevname],
   [], [], [#include "$srcdir/src/have.h"]
 )


@@ -231,13 +209,14 @@ AC_ARG_ENABLE(legacy-protocol,
 
 dnl These are defined in files in m4/
 
 
 dnl These are defined in files in m4/
 

-dnl AC_ARG_WITH(libgcrypt, AC_HELP_STRING([--with-libgcrypt], [enable use of libgcrypt instead of OpenSSL])], [])
-dnl AC_ARG_WITH(openssl, AC_HELP_STRING([--without-openssl], [disable support for OpenSSL])], [])
+dnl AC_ARG_WITH(libgcrypt, AS_HELP_STRING([--with-libgcrypt], [enable use of libgcrypt instead of OpenSSL])], [])
+dnl AC_ARG_WITH(openssl, AS_HELP_STRING([--without-openssl], [disable support for OpenSSL])], [])

 
 tinc_CURSES
 tinc_READLINE
 tinc_ZLIB
 tinc_LZO
 
 tinc_CURSES
 tinc_READLINE
 tinc_ZLIB
 tinc_LZO

+tinc_LZ4

 
 AS_IF([test "x$enable_legacy_protocol" != "xno"],
       [AS_IF([test -n "$with_libgcrypt"],
 
 AS_IF([test "x$enable_legacy_protocol" != "xno"],
       [AS_IF([test -n "$with_libgcrypt"],


@@ -260,11 +239,39 @@ AC_ARG_ENABLE(jumbograms,
   ]
 )
 
   ]
 )
 

-dnl Ensure runstatedir is set if we are using a version of autoconf that does not suppport it
+dnl Compiler hardening flags
+dnl No -fstack-protector-all because it doesn't work on all platforms or architectures.
+
+AX_CFLAGS_WARN_ALL(CFLAGS)
+
+AC_ARG_ENABLE([hardening], AS_HELP_STRING([--disable-hardening], [disable compiler and linker hardening flags]))
+AS_IF([test "x$enable_hardening" != "xno"],
+  [AX_CHECK_COMPILE_FLAG([-D_FORTIFY_SOURCE=2], [CPPFLAGS="$CPPFLAGS -D_FORTIFY_SOURCE=2"])
+   AX_CHECK_COMPILE_FLAG([-fwrapv], [CPPFLAGS="$CPPFLAGS -fwrapv"],
+   AX_CHECK_COMPILE_FLAG([-fno-strict-overflow], [CPPFLAGS="$CPPFLAGS -fno-strict-overflow"]))
+   case $host_os in
+     *mingw*)
+       AX_CHECK_LINK_FLAG([-Wl,--dynamicbase], [LDFLAGS="$LDFLAGS -Wl,--dynamicbase"])
+       AX_CHECK_LINK_FLAG([-Wl,--nxcompat], [LDFLAGS="$LDFLAGS -Wl,--nxcompat"])
+       AX_CHECK_LINK_FLAG([-lssp], [LDFLAGS="$LDFLAGS -lssp"])
+       ;;
+     *)
+       AX_CHECK_COMPILE_FLAG([-fPIE], [CPPFLAGS="$CPPFLAGS -fPIE"])
+       AX_CHECK_LINK_FLAG([-pie], [LDFLAGS="$LDFLAGS -pie"])
+       ;;
+   esac
+   AX_CHECK_LINK_FLAG([-Wl,-z,relro], [LDFLAGS="$LDFLAGS -Wl,-z,relro"])
+   AX_CHECK_LINK_FLAG([-Wl,-z,now], [LDFLAGS="$LDFLAGS -Wl,-z,now"])
+   AX_CHECK_COMPILE_FLAG([-W -Wextra -pedantic -Wreturn-type -Wold-style-definition -Wmissing-declarations -Wmissing-prototypes -Wstrict-prototypes -Wredundant-decls -Wbad-function-cast -Wwrite-strings -fdiagnostics-show-option -fstrict-aliasing -Wmissing-noreturn],
+     [CPPFLAGS="$CPPFLAGS -W -Wextra -pedantic -Wreturn-type -Wold-style-definition -Wmissing-declarations -Wmissing-prototypes -Wstrict-prototypes -Wredundant-decls -Wbad-function-cast -Wwrite-strings -fdiagnostics-show-option -fstrict-aliasing -Wmissing-noreturn"])
+  ]
+);
+
+dnl Ensure runstatedir is set if we are using a version of autoconf that does not support it

 if test "x$runstatedir" = "x"; then
   AC_SUBST([runstatedir], ['${localstatedir}/run'])
 fi
 
 if test "x$runstatedir" = "x"; then
   AC_SUBST([runstatedir], ['${localstatedir}/run'])
 fi
 

-AC_CONFIG_FILES([Makefile src/Makefile doc/Makefile gui/Makefile test/Makefile systemd/Makefile])
+AC_CONFIG_FILES([Makefile src/Makefile doc/Makefile test/Makefile test/testlib.sh systemd/Makefile bash_completion.d/Makefile])

 
 AC_OUTPUT
 
 AC_OUTPUT