configure.ac

#                                               -*- Autoconf -*-
# Process this file with autoconf to produce a configure script.
AC_PREREQ([2.71])
AC_INIT([sniproxy],[0.12.0])
AM_INIT_AUTOMAKE([subdir-objects])
AM_SILENT_RULES([yes])
AC_CANONICAL_HOST
AC_USE_SYSTEM_EXTENSIONS

AC_DEFUN([SNIPROXY_APPEND_CFLAG], [
  AS_VAR_PUSHDEF([cachevar], [sniproxy_cv_cflag_$2])
  AC_CACHE_CHECK([whether $CC supports $1], cachevar, [
    sniproxy_save_CFLAGS="$CFLAGS"
    CFLAGS="$CFLAGS $1"
    AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [[return 0;]])],
      [AS_VAR_SET(cachevar, [yes])],
      [AS_VAR_SET(cachevar, [no])])
    CFLAGS="$sniproxy_save_CFLAGS"
  ])
  AS_IF([test "x"AS_VAR_GET(cachevar) = xyes], [
    HARDEN_CFLAGS="$HARDEN_CFLAGS $1"
  ])
  AS_VAR_POPDEF([cachevar])
])

AC_DEFUN([SNIPROXY_APPEND_CPPFLAG], [
  AS_VAR_PUSHDEF([cachevar], [sniproxy_cv_cppflag_$2])
  AC_CACHE_CHECK([whether the compiler accepts $1], cachevar, [
    sniproxy_save_CPPFLAGS="$CPPFLAGS"
    CPPFLAGS="$CPPFLAGS $1"
    AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [[return 0;]])],
      [AS_VAR_SET(cachevar, [yes])],
      [AS_VAR_SET(cachevar, [no])])
    CPPFLAGS="$sniproxy_save_CPPFLAGS"
  ])
  AS_IF([test "x"AS_VAR_GET(cachevar) = xyes], [
    HARDEN_CPPFLAGS="$HARDEN_CPPFLAGS $1"
  ])
  AS_VAR_POPDEF([cachevar])
])

AC_DEFUN([SNIPROXY_APPEND_LDFLAG], [
  AS_VAR_PUSHDEF([cachevar], [sniproxy_cv_ldflag_$2])
  AC_CACHE_CHECK([whether the linker accepts $1], cachevar, [
    sniproxy_save_LDFLAGS="$LDFLAGS"
    LDFLAGS="$LDFLAGS $1"
    AC_LINK_IFELSE([AC_LANG_PROGRAM([], [[return 0;]])],
      [AS_VAR_SET(cachevar, [yes])],
      [AS_VAR_SET(cachevar, [no])])
    LDFLAGS="$sniproxy_save_LDFLAGS"
  ])
  AS_IF([test "x"AS_VAR_GET(cachevar) = xyes], [
    HARDEN_LDFLAGS="$HARDEN_LDFLAGS $1"
  ])
  AS_VAR_POPDEF([cachevar])
])

# Checks for programs.
AC_PROG_CC
AM_PROG_CC_C_O

AC_ARG_ENABLE([hardening],
  [AS_HELP_STRING([--disable-hardening], [Disable compiler and linker hardening flags])],
  [enable_hardening=$enableval],
  [enable_hardening=yes])

AC_ARG_ENABLE([asan],
  [AS_HELP_STRING([--enable-asan], [Enable AddressSanitizer (requires clang or gcc >= 4.8)])],
  [enable_asan=$enableval],
  [enable_asan=no])

AC_ARG_ENABLE([msan],
  [AS_HELP_STRING([--enable-msan], [Enable MemorySanitizer (requires clang with instrumented libc++)])],
  [enable_msan=$enableval],
  [enable_msan=no])

AC_ARG_ENABLE([ubsan],
  [AS_HELP_STRING([--enable-ubsan], [Enable UndefinedBehaviorSanitizer])],
  [enable_ubsan=$enableval],
  [enable_ubsan=no])

AC_ARG_ENABLE([tsan],
  [AS_HELP_STRING([--enable-tsan], [Enable ThreadSanitizer (incompatible with other sanitizers)])],
  [enable_tsan=$enableval],
  [enable_tsan=no])

AC_CACHE_CHECK([whether the compiler is clang], [sniproxy_cv_cc_is_clang], [
  AC_COMPILE_IFELSE([AC_LANG_PROGRAM([], [
#ifndef __clang__
#error "not clang"
#endif
  ])],
    [sniproxy_cv_cc_is_clang=yes],
    [sniproxy_cv_cc_is_clang=no])
])

HARDEN_CFLAGS=""
HARDEN_CPPFLAGS=""
HARDEN_LDFLAGS=""

AS_IF([test "x$enable_hardening" != "xno"], [
  SNIPROXY_APPEND_CPPFLAG([-U_FORTIFY_SOURCE], [u_fortify_source])
  SNIPROXY_APPEND_CPPFLAG([-D_FORTIFY_SOURCE=2], [fortify_source])
  SNIPROXY_APPEND_CFLAG([-fstack-protector-strong], [fstack_protector_strong])
  AS_IF([test "x$sniproxy_cv_cc_is_clang" != "xyes"], [
    SNIPROXY_APPEND_CFLAG([-fstack-clash-protection], [fstack_clash_protection])
  ])
  SNIPROXY_APPEND_CFLAG([-fno-strict-overflow], [fno_strict_overflow])
  SNIPROXY_APPEND_CFLAG([-fcf-protection=full], [fcf_protection])
  SNIPROXY_APPEND_CFLAG([-Wformat], [wformat])
  SNIPROXY_APPEND_CFLAG([-Wformat-security], [wformat_security])
  SNIPROXY_APPEND_CFLAG([-Werror=format-security], [werror_format_security])
  SNIPROXY_APPEND_CFLAG([-Wshadow], [wshadow])
  SNIPROXY_APPEND_CFLAG([-Wimplicit-fallthrough], [wimplicit_fallthrough])
  SNIPROXY_APPEND_CFLAG([-Wnull-dereference], [wnull_dereference])
  SNIPROXY_APPEND_CFLAG([-Wundef], [wundef])
  SNIPROXY_APPEND_CFLAG([-fno-delete-null-pointer-checks], [fno_delete_null_pointer_checks])
  SNIPROXY_APPEND_CFLAG([-fPIE], [fpie])
  SNIPROXY_APPEND_LDFLAG([-Wl,-z,relro], [ld_relro])
  SNIPROXY_APPEND_LDFLAG([-Wl,-z,now], [ld_now])
  SNIPROXY_APPEND_LDFLAG([-Wl,-z,noexecstack], [ld_noexecstack])
  SNIPROXY_APPEND_LDFLAG([-Wl,-z,separate-code], [ld_separate_code])
  SNIPROXY_APPEND_LDFLAG([-pie], [ld_pie])
], [
  AC_MSG_WARN([Compiler/linker hardening disabled])
])

AC_SUBST([HARDEN_CFLAGS])
AC_SUBST([HARDEN_CPPFLAGS])
AC_SUBST([HARDEN_LDFLAGS])

# Sanitizer support
SANITIZER_CFLAGS=""
SANITIZER_LDFLAGS=""

# Check for conflicting sanitizer options
sanitizer_count=0
AS_IF([test "x$enable_asan" = "xyes"], [sanitizer_count=$((sanitizer_count + 1))])
AS_IF([test "x$enable_msan" = "xyes"], [sanitizer_count=$((sanitizer_count + 1))])
AS_IF([test "x$enable_tsan" = "xyes"], [sanitizer_count=$((sanitizer_count + 1))])

AS_IF([test $sanitizer_count -gt 1], [
  AC_MSG_ERROR([Cannot enable multiple memory sanitizers (ASAN/MSAN/TSAN) simultaneously])
])

AS_IF([test "x$enable_asan" = "xyes"], [
  AC_MSG_NOTICE([Enabling AddressSanitizer])
  SANITIZER_CFLAGS="$SANITIZER_CFLAGS -fsanitize=address -fno-omit-frame-pointer"
  SANITIZER_LDFLAGS="$SANITIZER_LDFLAGS -fsanitize=address"
])

AS_IF([test "x$enable_msan" = "xyes"], [
  AC_MSG_NOTICE([Enabling MemorySanitizer])
  AC_MSG_WARN([MemorySanitizer requires instrumented libc++ - ensure you have built and linked against it])
  SANITIZER_CFLAGS="$SANITIZER_CFLAGS -fsanitize=memory -fno-omit-frame-pointer -fsanitize-memory-track-origins"
  SANITIZER_LDFLAGS="$SANITIZER_LDFLAGS -fsanitize=memory"
])

AS_IF([test "x$enable_ubsan" = "xyes"], [
  AC_MSG_NOTICE([Enabling UndefinedBehaviorSanitizer])
  SANITIZER_CFLAGS="$SANITIZER_CFLAGS -fsanitize=undefined -fno-sanitize-recover=all"
  SANITIZER_LDFLAGS="$SANITIZER_LDFLAGS -fsanitize=undefined"
])

AS_IF([test "x$enable_tsan" = "xyes"], [
  AC_MSG_NOTICE([Enabling ThreadSanitizer])
  SANITIZER_CFLAGS="$SANITIZER_CFLAGS -fsanitize=thread -fno-omit-frame-pointer"
  SANITIZER_LDFLAGS="$SANITIZER_LDFLAGS -fsanitize=thread"
])

# Disable hardening if sanitizers are enabled (some flags conflict)
AS_IF([test "x$enable_asan" = "xyes" -o "x$enable_msan" = "xyes" -o "x$enable_tsan" = "xyes" -o "x$enable_ubsan" = "xyes"], [
  AS_IF([test "x$enable_hardening" = "xyes"], [
    AC_MSG_WARN([Disabling hardening flags due to sanitizer usage (some flags conflict)])
    enable_hardening=no
  ])
])

AC_SUBST([SANITIZER_CFLAGS])
AC_SUBST([SANITIZER_LDFLAGS])

# Checks for libraries.
AC_CHECK_LIB([ev], [ev_run], [],
	     [AC_MSG_ERROR([libev is required])])
AC_CHECK_LIB([pcre2-8], [pcre2_compile_8], [],
	     [AC_MSG_ERROR([libpcre2 is required])])
PCRE2_LIBS='-lpcre2-8'
PCRE2_CFLAGS=''
AC_SUBST([PCRE2_LIBS])
AC_SUBST([PCRE2_CFLAGS])

AC_CHECK_HEADERS([ares.h], [],
  [AC_MSG_ERROR([c-ares headers are required])])
AC_CHECK_HEADERS([ares_dns.h], [],
  [AC_MSG_ERROR([c-ares addrinfo headers are required])])
AC_CHECK_LIB([cares], [ares_library_init], [],
  [AC_MSG_ERROR([c-ares is required])])

AC_CHECK_HEADERS([bsd/stdlib.h bsd/string.h bsd/unistd.h])
AC_SEARCH_LIBS([arc4random], [bsd], [LIBBSD_LIBS="$ac_cv_search_arc4random"], [LIBBSD_LIBS=""])
AS_IF([test "x$LIBBSD_LIBS" = "xnone required"], [LIBBSD_LIBS=""])
AC_CHECK_FUNCS([arc4random], [],
  [AC_MSG_ERROR([arc4random() is required; install libbsd-dev or provide arc4random])])
AC_SEARCH_LIBS([strlcpy], [bsd], [
  AC_DEFINE([HAVE_STRLCPY], 1, [Define to 1 if you have the `strlcpy' function.])
  AS_IF([test "x$ac_cv_search_strlcpy" != "xnone required"], [
    AS_IF([test "x$LIBBSD_LIBS" = "x"], [
      LIBBSD_LIBS="$ac_cv_search_strlcpy"
    ], [AS_IF([test "x$LIBBSD_LIBS" != "x$ac_cv_search_strlcpy"], [
      LIBBSD_LIBS="$LIBBSD_LIBS $ac_cv_search_strlcpy"
    ])])
  ])
], [
  AC_MSG_ERROR([strlcpy() is required; install libbsd-dev])
])
AC_SEARCH_LIBS([reallocarray], [bsd], [
  AC_DEFINE([HAVE_REALLOCARRAY], 1, [Define to 1 if you have the `reallocarray' function.])
], [
  AC_MSG_WARN([reallocarray() not found; using built-in fallback])
])
AC_SUBST([LIBBSD_LIBS])

AC_SEARCH_LIBS([floor], [m])

AC_CHECK_HEADERS([openssl/evp.h openssl/rand.h openssl/sha.h], [],
  [AC_MSG_ERROR([OpenSSL/LibreSSL headers with ChaCha20-Poly1305 are required])])
AC_CHECK_LIB([crypto], [EVP_chacha20_poly1305], [],
  [AC_MSG_ERROR([libcrypto with ChaCha20-Poly1305 is required])])
LIBCRYPTO_LIBS='-lcrypto'
AC_SUBST([LIBCRYPTO_LIBS])

AC_ARG_ENABLE([rfc3339-timestamps],
  [AS_HELP_STRING([--enable-rfc3339-timestamps], [Enable RFC3339 timestamps])],
  [AC_DEFINE([RFC3339_TIMESTAMP], 1, [RFC3339 timestamps enabled])])

# Check for libseccomp (Linux only)
LIBSECCOMP_LIBS=""
case "$host_os" in
  linux*)
    AC_CHECK_HEADERS([seccomp.h])
    AC_SEARCH_LIBS([seccomp_init], [seccomp], [
      AS_IF([test "x$ac_cv_search_seccomp_init" != "xnone required"],
        [LIBSECCOMP_LIBS="$ac_cv_search_seccomp_init"],
        [LIBSECCOMP_LIBS=""])
      AC_DEFINE([HAVE_SECCOMP], 1, [Define to 1 if libseccomp is available])
    ])
    ;;
esac
AC_SUBST([LIBSECCOMP_LIBS])

# Check for Capsicum (FreeBSD only)
case "$host_os" in
  freebsd*)
    AC_CHECK_HEADERS([sys/capsicum.h])
    AC_CHECK_FUNCS([cap_enter cap_rights_limit])
    AS_IF([test "x$ac_cv_func_cap_enter" = xyes -a "x$ac_cv_func_cap_rights_limit" = xyes], [
      AC_DEFINE([HAVE_CAPSICUM], 1, [Define to 1 if Capsicum is available])
    ])
    ;;
esac

AC_CHECK_FUNCS([accept4 closefrom daemon setproctitle mkostemp explicit_bzero memset_s])

# Enable large file support (so we can log more than 2GB)
AC_SYS_LARGEFILE

AC_CONFIG_FILES([Makefile
                 src/Makefile
                 man/Makefile
                 tests/Makefile
                 scripts/Makefile])

AC_OUTPUT