ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/gvpe/configure.ac
(Generate patch)

Comparing gvpe/configure.ac (file contents):
Revision 1.58 by root, Tue Mar 8 17:33:30 2011 UTC vs.
Revision 1.66 by root, Thu Oct 25 04:32:26 2018 UTC

1dnl Process this file with autoconf to produce a configure script. 1dnl Process this file with autoconf to produce a configure script.
2 2
3AC_PREREQ(2.59) 3AC_PREREQ(2.69)
4AC_INIT 4AC_INIT
5AC_CONFIG_SRCDIR([src/gvpe.C]) 5AC_CONFIG_SRCDIR([src/gvpe.C])
6AC_CANONICAL_TARGET 6AC_CANONICAL_TARGET
7AM_INIT_AUTOMAKE(gvpe, 2.24) 7AM_INIT_AUTOMAKE(gvpe, 3.1)
8AC_CONFIG_HEADERS([config.h]) 8AC_CONFIG_HEADERS([config.h])
9AM_MAINTAINER_MODE 9AM_MAINTAINER_MODE
10 10
11AH_TOP([ 11AH_TOP([
12#ifndef CONFIG_H__ 12#ifndef CONFIG_H__
… …
45# define CLOCALE <clocale> 45# define CLOCALE <clocale>
46#else 46#else
47# define CLOCALE <locale.h> 47# define CLOCALE <locale.h>
48#endif 48#endif
49]) 49])
50
51dnl Include the macros from the m4/ directory
52AM_ACLOCAL_INCLUDE(m4)
53 50
54AM_GNU_GETTEXT([external]) 51AM_GNU_GETTEXT([external])
55AM_GNU_GETTEXT_VERSION(0.11.5) 52AM_GNU_GETTEXT_VERSION(0.11.5)
56 53
57# Enable GNU extensions. 54# Enable GNU extensions.
… …
237AC_CACHE_SAVE 234AC_CACHE_SAVE
238 235
239dnl These are defined in files in m4/ 236dnl These are defined in files in m4/
240tinc_TUNTAP 237tinc_TUNTAP
241 238
242tinc_OPENSSL 239PKG_CHECK_MODULES([LIBCRYPTO], [libcrypto >= 1])
243if test "x$openssl_include" != x; then
244 CXXFLAGS="$CXXFLAGS -I$openssl_include"
245fi
246dnl tinc_ZLIB
247 240
248AC_ARG_ENABLE(threads, 241AC_ARG_ENABLE(threads,
249 [AS_HELP_STRING(--enable-threads,try to use threads for long-running asynchronous operations (default enabled).)], 242 [AS_HELP_STRING(--enable-threads,try to use threads for long-running asynchronous operations (default enabled).)],
250 [try_threads=$enableval], 243 [try_threads=$enableval],
251 [try_threads=yes] 244 [try_threads=yes]
… …
330 323
331 AC_DEFINE_UNQUOTED(ENABLE_DNS, 1, [DNS tunnel protocol support.]) 324 AC_DEFINE_UNQUOTED(ENABLE_DNS, 1, [DNS tunnel protocol support.])
332 ] 325 ]
333) 326)
334 327
328RSA=3072
329AC_ARG_ENABLE(rsa-length,
330 [AS_HELP_STRING(--enable-rsa-length=BITS,[
331 use BITS rsa keys (default 3072). Allowed values are 2048-10240.])],
332 RSA=$enableval
333)
334AC_DEFINE_UNQUOTED(RSABITS, $RSA, [Size of RSA keys.])
335
335HMAC=12 336HMACSIZE=12
336AC_ARG_ENABLE(hmac-length, 337AC_ARG_ENABLE(hmac-length,
337 [AS_HELP_STRING(--enable-hmac-length=BYTES,[ 338 [AS_HELP_STRING(--enable-hmac-length=BYTES,[
338 use a hmac of length BYTES bytes (default 12). Allowed values are 4, 8, 12, 16.])], 339 use a hmac of length BYTES bytes (default 12). Allowed values are 4, 8, 12, 16.])],
339 HMAC=$enableval 340 HMACSIZE=$enableval
340) 341)
341AC_DEFINE_UNQUOTED(HMACLENGTH, $HMAC, [Size of HMAC in each packet in bytes.]) 342AC_DEFINE_UNQUOTED(HMACLENGTH, $HMACSIZE, [Size of HMAC in each packet in bytes.])
342
343RAND=8
344AC_ARG_ENABLE(rand-length,
345 [AS_HELP_STRING(--enable-rand-length=BYTES,
346 [use BYTES bytes of extra randomness (default 8). Allowed values are 0, 4, 8.])],
347 RAND=$enableval
348)
349AC_DEFINE_UNQUOTED(RAND_SIZE, $RAND, [Add this many bytes of randomness to each packet.])
350 343
351MTU=1500 344MTU=1500
352AC_ARG_ENABLE(max-mtu, 345AC_ARG_ENABLE(max-mtu,
353 [AS_HELP_STRING(--enable-max-mtu=BYTES,enable mtu sizes upto BYTES bytes (default 1500). Use 9100 for jumbogram support.)], 346 [AS_HELP_STRING(--enable-max-mtu=BYTES,enable mtu sizes upto BYTES bytes (default 1500). Use 9100 for jumbogram support.)],
354 MTU=$enableval 347 MTU=$enableval
355) 348)
356AC_DEFINE_UNQUOTED(MAX_MTU, $MTU + 14, [Maximum MTU supported.]) 349AC_DEFINE_UNQUOTED(MAX_MTU, ($MTU + 14), [Maximum MTU supported.])
357 350
358COMPRESS=1 351COMPRESS=1
359AC_ARG_ENABLE(compression, 352AC_ARG_ENABLE(compression,
360 [AS_HELP_STRING(--disable-compression,Disable compression support.)], 353 [AS_HELP_STRING(--disable-compression,Disable compression support.)],
361 if test "x$enableval" = xno; then 354 if test "x$enableval" = xno; then
362 COMPRESS=0 355 COMPRESS=0
363 fi 356 fi
364) 357)
365AC_DEFINE_UNQUOTED(ENABLE_COMPRESSION, $COMPRESS, [Enable compression support.]) 358AC_DEFINE_UNQUOTED(ENABLE_COMPRESSION, $COMPRESS, [Enable compression support.])
366 359
367CIPHER=aes_128_cbc 360CIPHER=aes_128_ctr
368AC_ARG_ENABLE(cipher, 361AC_ARG_ENABLE(cipher,
369 [AS_HELP_STRING(--enable-cipher=CIPHER,[ 362 [AS_HELP_STRING(--enable-cipher=CIPHER,[
370 Select the symmetric cipher (default "aes-128"). 363 Select the symmetric cipher (default "aes-128").
371 Must be one of "bf" (blowfish), "aes-128" (rijndael), "aes-192" or "aes-256".])], 364 Must be one of "aes-128" (rijndael), "aes-192", or "aes-256".])],
372 if test "x$enableval" = xbf ; then CIPHER=bf_cbc ; fi 365 #if test "x$enableval" = xbf ; then CIPHER=bf_ctr ; fi
373 if test "x$enableval" = xaes-128; then CIPHER=aes_128_cbc; fi 366 if test "x$enableval" = xaes-128 ; then CIPHER=aes_128_ctr ; fi
374 if test "x$enableval" = xaes-192; then CIPHER=aes_192_cbc; fi 367 if test "x$enableval" = xaes-192 ; then CIPHER=aes_192_ctr ; fi
375 if test "x$enableval" = xaes-256; then CIPHER=aes_256_cbc; fi 368 if test "x$enableval" = xaes-256 ; then CIPHER=aes_256_ctr ; fi
369 #if test "x$enableval" = xcamellia-128; then CIPHER=camellia_128_ctr; fi
370 #if test "x$enableval" = xcamellia-256; then CIPHER=camellia_256_ctr; fi
376) 371)
377AC_DEFINE_UNQUOTED(ENABLE_CIPHER, EVP_${CIPHER}, [Select the symmetric cipher to use.]) 372AC_DEFINE_UNQUOTED(ENABLE_CIPHER, EVP_${CIPHER}, [Select the symmetric cipher to use.])
378 373
379DIGEST=ripemd160 374HMAC=sha1
380AC_ARG_ENABLE(digest, 375AC_ARG_ENABLE(hmac-digest,
381 [AS_HELP_STRING(--enable-digest=CIPHER,[ 376 [AS_HELP_STRING(--enable-hmac-digest=HMAC,[
382 Select the digest algorithm to use (default "ripemd160"). Must be one of 377 Select the HMAC digest algorithm to use (default "sha1"). Must be one of
383 "sha512", "sha256", "sha1" (somewhat insecure), "ripemd160", "md5" (insecure) or "md4" (insecure).])], 378 "sha512", "sha256", "sha1", "ripemd160", "whirlpool".])],
379 if test "x$enableval" = xwhirlpool; then HMAC=whirlpool; fi
380 if test "x$enableval" = xsha512 ; then HMAC=sha512 ; fi
381 if test "x$enableval" = xsha256 ; then HMAC=sha256 ; fi
382 if test "x$enableval" = xsha1 ; then HMAC=sha1 ; fi
383 if test "x$enableval" = xripemd160; then HMAC=ripemd160; fi
384)
385AC_DEFINE_UNQUOTED(ENABLE_HMAC, EVP_${HMAC}, [Select the HMAC digest algorithm to use.])
386
387AUTH=sha512
388AC_ARG_ENABLE(auth-digest,
389 [AS_HELP_STRING(--enable-auth-digest=DIGEST,[
390 Select the hmac algorithm to use (default "sha512"). Must be one of
391 "sha512", "sha256", "whirlpool".])],
392 if test "x$enableval" = xwhirlpool; then AUTH=whirlpool; fi
384 if test "x$enableval" = xsha512 ; then DIGEST=sha512 ; fi 393 if test "x$enableval" = xsha512 ; then AUTH=sha512 ; fi
385 if test "x$enableval" = xsha256 ; then DIGEST=sha256 ; fi 394 if test "x$enableval" = xsha256 ; then AUTH=sha256 ; fi
386 if test "x$enableval" = xsha1 ; then DIGEST=sha1 ; fi
387 if test "x$enableval" = xripemd160; then DIGEST=ripemd160; fi
388 if test "x$enableval" = xmd5 ; then DIGEST=md5 ; fi
389 if test "x$enableval" = xmd4 ; then DIGEST=md4 ; fi
390) 395)
391AC_DEFINE_UNQUOTED(ENABLE_DIGEST, EVP_${DIGEST}, [Select the digest algorithm to use.]) 396AC_DEFINE_UNQUOTED(ENABLE_AUTH, EVP_${AUTH}, [Select the auth digest algorithm to use.])
392 397
393if $CXX -v --help 2>&1 | grep -q fno-rtti; then 398if $CXX -v --help 2>&1 | grep -q fno-rtti; then
394 CXXFLAGS="$CXXFLAGS -fno-rtti" 399 CXXFLAGS="$CXXFLAGS -fno-rtti"
395fi 400fi
396 401
… …
401LIBS="$EXTRA_LIBS $LIBS" 406LIBS="$EXTRA_LIBS $LIBS"
402 407
403dnl if $CXX -v --help 2>&1 | grep -q ffunction-sections; then 408dnl if $CXX -v --help 2>&1 | grep -q ffunction-sections; then
404dnl CXXFLAGS="$CXXFLAGS -ffunction-sections" 409dnl CXXFLAGS="$CXXFLAGS -ffunction-sections"
405dnl fi 410dnl fi
406dnl 411dnl
407dnl if $LD -v --help 2>&1 | grep -q gc-sections; then 412dnl if $LD -v --help 2>&1 | grep -q gc-sections; then
408dnl LDFLAGS="$LDFLAGS -Wl,--gc-sections" 413dnl LDFLAGS="$LDFLAGS -Wl,--gc-sections"
409dnl fi 414dnl fi
410 415
411AC_SUBST(INCLUDES) 416AC_SUBST(INCLUDES)
… …
421echo 426echo
422echo "***" 427echo "***"
423echo "*** Configuration Summary" 428echo "*** Configuration Summary"
424echo "***" 429echo "***"
425echo "*** Kernel Iface: $IFTYPE/$IFSUBTYPE" 430echo "*** Kernel Iface: $IFTYPE/$IFSUBTYPE"
431echo "*** RSA size: $RSA"
426echo "*** Cipher used: $CIPHER" 432echo "*** Cipher used: $CIPHER"
427echo "*** Digest used: $DIGEST" 433echo "*** Digest used: $DIGEST"
434echo "*** Authdigest: $AUTH"
428echo "*** HMAC length: $HMAC" 435echo "*** HMAC length: $HMAC"
429echo "*** RAND used: $RAND"
430echo "*** Max. MTU: $MTU" 436echo "*** Max. MTU: $MTU"
431 437
432echo "***" 438echo "***"
433echo "*** Enable options:" 439echo "*** Enable options:"
434grep ENABLE_ config.h | sed -e 's/^/*** /' 440grep ENABLE_ config.h | sed -e 's/^/*** /'
435 441
436if test "x$DIGEST" = xmd4; then 442if test "$HMACSIZE" -lt 12; then
437echo "***" 443echo "***"
438echo "*** WARNING: The digest you have chosen ($DIGEST) is known to be insecure"
439fi
440
441if test "x$DIGEST" = xmd5; then
442echo "***"
443echo "*** WARNING: The digest you have chosen ($DIGEST) is probably insecure"
444fi
445
446if test "$HMAC" -lt 12; then
447echo "***"
448echo "*** WARNING: The hmac length you have chosen ($HMAC) is probably insecure" 444echo "*** WARNING: The hmac length you have chosen ($HMACSIZE) is quite insecure"
449fi
450
451if test "$RAND" -lt 8; then
452echo "***"
453echo "*** WARNING: The random prefix you have chosen ($RAND) is probably insecure"
454fi 445fi
455 446
456echo "***" 447echo "***"
457echo 448echo
458 449
450if pkg-config --exists 'libcrypto >= 1.1 libcrypto < 2.0'; then
451 cat <<EOF
452@<:@33m
453***
454*** WARNING WARNING WARNING WARNING WARNING WARNING WARNING
455***
456*** You seem to configure gvpe with OpenSSL 1.1 or newer.
457*** While this probably compiles, please note that this is not only
458*** unsupported, but also discouraged.
459***
460*** It is recommended to use either OpenSSL 1.0, as long as that is still
461*** supported, or LibreSSL (https://www.libressl.org/).
462***
463*** This is not a political issue - while porting GVPE to the newer
464*** OpenSSL 1.1 API, I encountered two incompatible API changes that were
465*** not documented, were not caught while compiling but caused security
466*** issues. When reported, the reaction of the OpenSSL developers was to
467*** update the documentation.
468***
469*** As a result, I lost all confidence in the ability and desire of
470*** OpenSSL developers to create a safe API, and would highly recommend
471*** switching to LibreSSL which explicitly avoids such braking changes.
472***
473*** WARNING WARNING WARNING WARNING WARNING WARNING WARNING
474***
475*** Again, do not use OpenSSL 1.1 and complain if stuff breaks.
476*** You have been warned, but your choice is respected.
477***
478@<:@0m
459 479
480EOF
481fi
482
483

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines