e244d50064
`libcurl.pc` `Libs.private` (since 8.11.0, and in `Libs` before 7.20.0) and `curl-config` `--static-libs` (since 7.17.1, and in `Libs` between 7.7.2-7.25.0). This included all flags inherited from the environment, in addition to those coming from dependency detections. To avoid spilling all linker flags inherited from the environment to the libcurl config files, this patch omits them all, except `-L`, `-F`, `--library-path=` and `-framework` options, which are still passed. The rationale for the exceptions is that `LIBS` is passed as-is, and `LDFLAGS`, `LIBS` are the canonical way to pass custom libs options to a build. `LIBS` may not work without a matching custom libpath. This brings autotools behaviour closer to cmake, and `curl-config` closer to `libcurl.pc`. Follow-up to9f56bb608e#14681 Follow-up to4c8adc8feeReported-by: Peter Marko Fixes #15533 Closes #15550
423 lines
12 KiB
Plaintext
423 lines
12 KiB
Plaintext
#***************************************************************************
|
|
# _ _ ____ _
|
|
# Project ___| | | | _ \| |
|
|
# / __| | | | |_) | |
|
|
# | (__| |_| | _ <| |___
|
|
# \___|\___/|_| \_\_____|
|
|
#
|
|
# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
|
|
#
|
|
# This software is licensed as described in the file COPYING, which
|
|
# you should have received as part of this distribution. The terms
|
|
# are also available at https://curl.se/docs/copyright.html.
|
|
#
|
|
# You may opt to use, copy, modify, merge, publish, distribute and/or sell
|
|
# copies of the Software, and permit persons to whom the Software is
|
|
# furnished to do so, under the terms of the COPYING file.
|
|
#
|
|
# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
|
|
# KIND, either express or implied.
|
|
#
|
|
# SPDX-License-Identifier: curl
|
|
#
|
|
#***************************************************************************
|
|
|
|
# File version for 'aclocal' use. Keep it a single number.
|
|
# serial 5
|
|
|
|
dnl **********************************************************************
|
|
dnl Check for OpenSSL libraries and headers
|
|
dnl **********************************************************************
|
|
|
|
AC_DEFUN([CURL_WITH_OPENSSL], [
|
|
if test "x$OPT_OPENSSL" != xno; then
|
|
ssl_msg=
|
|
|
|
dnl backup the pre-ssl variables
|
|
CLEANLDFLAGS="$LDFLAGS"
|
|
CLEANLDFLAGSPC="$LDFLAGSPC"
|
|
CLEANCPPFLAGS="$CPPFLAGS"
|
|
CLEANLIBS="$LIBS"
|
|
|
|
dnl This is for MSYS/MinGW
|
|
case $host in
|
|
*-*-msys* | *-*-mingw*)
|
|
AC_MSG_CHECKING([for gdi32])
|
|
my_ac_save_LIBS=$LIBS
|
|
LIBS="-lgdi32 $LIBS"
|
|
AC_LINK_IFELSE([ AC_LANG_PROGRAM([[
|
|
#include <windef.h>
|
|
#include <wingdi.h>
|
|
]],
|
|
[[
|
|
GdiFlush();
|
|
]])],
|
|
[ dnl worked!
|
|
AC_MSG_RESULT([yes])],
|
|
[ dnl failed, restore LIBS
|
|
LIBS=$my_ac_save_LIBS
|
|
AC_MSG_RESULT(no)]
|
|
)
|
|
;;
|
|
esac
|
|
|
|
case "$OPT_OPENSSL" in
|
|
yes)
|
|
dnl --with-openssl (without path) used
|
|
PKGTEST="yes"
|
|
PREFIX_OPENSSL=
|
|
;;
|
|
*)
|
|
dnl check the given --with-openssl spot
|
|
PKGTEST="no"
|
|
PREFIX_OPENSSL=$OPT_OPENSSL
|
|
|
|
dnl Try pkg-config even when cross-compiling. Since we
|
|
dnl specify PKG_CONFIG_LIBDIR we're only looking where
|
|
dnl the user told us to look
|
|
OPENSSL_PCDIR="$OPT_OPENSSL/lib/pkgconfig"
|
|
if test -f "$OPENSSL_PCDIR/openssl.pc"; then
|
|
AC_MSG_NOTICE([PKG_CONFIG_LIBDIR will be set to "$OPENSSL_PCDIR"])
|
|
PKGTEST="yes"
|
|
fi
|
|
|
|
if test "$PKGTEST" != "yes"; then
|
|
# try lib64 instead
|
|
OPENSSL_PCDIR="$OPT_OPENSSL/lib64/pkgconfig"
|
|
if test -f "$OPENSSL_PCDIR/openssl.pc"; then
|
|
AC_MSG_NOTICE([PKG_CONFIG_LIBDIR will be set to "$OPENSSL_PCDIR"])
|
|
PKGTEST="yes"
|
|
fi
|
|
fi
|
|
|
|
if test "$PKGTEST" != "yes"; then
|
|
if test ! -f "$PREFIX_OPENSSL/include/openssl/ssl.h"; then
|
|
AC_MSG_ERROR([$PREFIX_OPENSSL is a bad --with-openssl prefix!])
|
|
fi
|
|
fi
|
|
|
|
dnl in case pkg-config comes up empty, use what we got
|
|
dnl via --with-openssl
|
|
LIB_OPENSSL="$PREFIX_OPENSSL/lib$libsuff"
|
|
if test "$PREFIX_OPENSSL" != "/usr" ; then
|
|
SSL_LDFLAGS="-L$LIB_OPENSSL"
|
|
SSL_CPPFLAGS="-I$PREFIX_OPENSSL/include"
|
|
fi
|
|
;;
|
|
esac
|
|
|
|
if test "$PKGTEST" = "yes"; then
|
|
|
|
CURL_CHECK_PKGCONFIG(openssl, [$OPENSSL_PCDIR])
|
|
|
|
if test "$PKGCONFIG" != "no" ; then
|
|
SSL_LIBS=`CURL_EXPORT_PCDIR([$OPENSSL_PCDIR]) dnl
|
|
$PKGCONFIG --libs-only-l --libs-only-other openssl 2>/dev/null`
|
|
|
|
SSL_LDFLAGS=`CURL_EXPORT_PCDIR([$OPENSSL_PCDIR]) dnl
|
|
$PKGCONFIG --libs-only-L openssl 2>/dev/null`
|
|
|
|
SSL_CPPFLAGS=`CURL_EXPORT_PCDIR([$OPENSSL_PCDIR]) dnl
|
|
$PKGCONFIG --cflags-only-I openssl 2>/dev/null`
|
|
|
|
AC_SUBST(SSL_LIBS)
|
|
AC_MSG_NOTICE([pkg-config: SSL_LIBS: "$SSL_LIBS"])
|
|
AC_MSG_NOTICE([pkg-config: SSL_LDFLAGS: "$SSL_LDFLAGS"])
|
|
AC_MSG_NOTICE([pkg-config: SSL_CPPFLAGS: "$SSL_CPPFLAGS"])
|
|
|
|
LIB_OPENSSL=`echo $SSL_LDFLAGS | sed -e 's/^-L//'`
|
|
|
|
dnl use the values pkg-config reported. This is here
|
|
dnl instead of below with CPPFLAGS and LDFLAGS because we only
|
|
dnl learn about this via pkg-config. If we only have
|
|
dnl the argument to --with-openssl we don't know what
|
|
dnl additional libs may be necessary. Hope that we
|
|
dnl don't need any.
|
|
LIBS="$SSL_LIBS $LIBS"
|
|
fi
|
|
fi
|
|
|
|
dnl finally, set flags to use SSL
|
|
CPPFLAGS="$CPPFLAGS $SSL_CPPFLAGS"
|
|
LDFLAGS="$LDFLAGS $SSL_LDFLAGS"
|
|
LDFLAGSPC="$LDFLAGSPC $SSL_LDFLAGS"
|
|
|
|
AC_CHECK_LIB(crypto, HMAC_Update,[
|
|
HAVECRYPTO="yes"
|
|
LIBS="-lcrypto $LIBS"
|
|
],[
|
|
if test -n "$LIB_OPENSSL" ; then
|
|
LDFLAGS="$CLEANLDFLAGS -L$LIB_OPENSSL"
|
|
LDFLAGSPC="$CLEANLDFLAGSPC -L$LIB_OPENSSL"
|
|
fi
|
|
if test "$PKGCONFIG" = "no" -a -n "$PREFIX_OPENSSL" ; then
|
|
# only set this if pkg-config wasn't used
|
|
CPPFLAGS="$CLEANCPPFLAGS -I$PREFIX_OPENSSL/include"
|
|
fi
|
|
# Linking previously failed, try extra paths from --with-openssl or
|
|
# pkg-config. Use a different function name to avoid reusing the earlier
|
|
# cached result.
|
|
AC_CHECK_LIB(crypto, HMAC_Init_ex,[
|
|
HAVECRYPTO="yes"
|
|
LIBS="-lcrypto $LIBS"], [
|
|
|
|
dnl still no, but what about with -ldl?
|
|
AC_MSG_CHECKING([OpenSSL linking with -ldl])
|
|
LIBS="-lcrypto $CLEANLIBS -ldl"
|
|
AC_LINK_IFELSE([ AC_LANG_PROGRAM([[
|
|
#include <openssl/err.h>
|
|
]], [[
|
|
ERR_clear_error();
|
|
]]) ],
|
|
[
|
|
AC_MSG_RESULT(yes)
|
|
HAVECRYPTO="yes"
|
|
],
|
|
[
|
|
AC_MSG_RESULT(no)
|
|
dnl ok, so what about both -ldl and -lpthread?
|
|
dnl This may be necessary for static libraries.
|
|
|
|
AC_MSG_CHECKING([OpenSSL linking with -ldl and -lpthread])
|
|
LIBS="-lcrypto $CLEANLIBS -ldl -lpthread"
|
|
AC_LINK_IFELSE([
|
|
AC_LANG_PROGRAM([[
|
|
#include <openssl/err.h>
|
|
]], [[
|
|
ERR_clear_error();
|
|
]])],
|
|
[
|
|
AC_MSG_RESULT(yes)
|
|
HAVECRYPTO="yes"
|
|
],
|
|
[
|
|
AC_MSG_RESULT(no)
|
|
LDFLAGS="$CLEANLDFLAGS"
|
|
LDFLAGSPC="$CLEANLDFLAGSPC"
|
|
CPPFLAGS="$CLEANCPPFLAGS"
|
|
LIBS="$CLEANLIBS"
|
|
])
|
|
])
|
|
])
|
|
])
|
|
|
|
if test X"$HAVECRYPTO" = X"yes"; then
|
|
dnl This is only reasonable to do if crypto actually is there: check for
|
|
dnl SSL libs NOTE: it is important to do this AFTER the crypto lib
|
|
|
|
AC_CHECK_LIB(ssl, SSL_connect)
|
|
|
|
if test "$ac_cv_lib_ssl_SSL_connect" != yes; then
|
|
dnl we didn't find the SSL lib, try the RSAglue/rsaref stuff
|
|
AC_MSG_CHECKING(for ssl with RSAglue/rsaref libs in use);
|
|
OLIBS=$LIBS
|
|
LIBS="-lRSAglue -lrsaref $LIBS"
|
|
AC_CHECK_LIB(ssl, SSL_connect)
|
|
if test "$ac_cv_lib_ssl_SSL_connect" != yes; then
|
|
dnl still no SSL_connect
|
|
AC_MSG_RESULT(no)
|
|
LIBS=$OLIBS
|
|
else
|
|
AC_MSG_RESULT(yes)
|
|
fi
|
|
|
|
else
|
|
|
|
dnl Have the libraries--check for OpenSSL headers
|
|
AC_CHECK_HEADERS(openssl/x509.h openssl/rsa.h openssl/crypto.h \
|
|
openssl/pem.h openssl/ssl.h openssl/err.h,
|
|
ssl_msg="OpenSSL"
|
|
test openssl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
|
|
OPENSSL_ENABLED=1
|
|
AC_DEFINE(USE_OPENSSL, 1, [if OpenSSL is in use]))
|
|
|
|
if test $ac_cv_header_openssl_x509_h = no; then
|
|
dnl we don't use the "action" part of the AC_CHECK_HEADERS macro
|
|
dnl since 'err.h' might in fact find a krb4 header with the same
|
|
dnl name
|
|
AC_CHECK_HEADERS(x509.h rsa.h crypto.h pem.h ssl.h err.h)
|
|
|
|
if test $ac_cv_header_x509_h = yes &&
|
|
test $ac_cv_header_crypto_h = yes &&
|
|
test $ac_cv_header_ssl_h = yes; then
|
|
dnl three matches
|
|
ssl_msg="OpenSSL"
|
|
OPENSSL_ENABLED=1
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
if test X"$OPENSSL_ENABLED" != X"1"; then
|
|
LIBS="$CLEANLIBS"
|
|
fi
|
|
|
|
if test X"$OPT_OPENSSL" != Xoff &&
|
|
test "$OPENSSL_ENABLED" != "1"; then
|
|
AC_MSG_ERROR([OpenSSL libs and/or directories were not found where specified!])
|
|
fi
|
|
fi
|
|
|
|
if test X"$OPENSSL_ENABLED" = X"1"; then
|
|
dnl These can only exist if OpenSSL exists
|
|
|
|
AC_MSG_CHECKING([for BoringSSL])
|
|
AC_COMPILE_IFELSE([
|
|
AC_LANG_PROGRAM([[
|
|
#include <openssl/base.h>
|
|
]],[[
|
|
#ifndef OPENSSL_IS_BORINGSSL
|
|
#error not boringssl
|
|
#endif
|
|
]])
|
|
],[
|
|
AC_MSG_RESULT([yes])
|
|
ssl_msg="BoringSSL"
|
|
OPENSSL_IS_BORINGSSL=1
|
|
],[
|
|
AC_MSG_RESULT([no])
|
|
])
|
|
|
|
AC_MSG_CHECKING([for AWS-LC])
|
|
AC_COMPILE_IFELSE([
|
|
AC_LANG_PROGRAM([[
|
|
#include <openssl/base.h>
|
|
]],[[
|
|
#ifndef OPENSSL_IS_AWSLC
|
|
#error not AWS-LC
|
|
#endif
|
|
]])
|
|
],[
|
|
AC_MSG_RESULT([yes])
|
|
ssl_msg="AWS-LC"
|
|
OPENSSL_IS_BORINGSSL=1
|
|
],[
|
|
AC_MSG_RESULT([no])
|
|
])
|
|
|
|
AC_MSG_CHECKING([for LibreSSL])
|
|
AC_COMPILE_IFELSE([
|
|
AC_LANG_PROGRAM([[
|
|
#include <openssl/opensslv.h>
|
|
]],[[
|
|
int dummy = LIBRESSL_VERSION_NUMBER;
|
|
]])
|
|
],[
|
|
AC_MSG_RESULT([yes])
|
|
AC_DEFINE_UNQUOTED(HAVE_LIBRESSL, 1,
|
|
[Define to 1 if using LibreSSL.])
|
|
ssl_msg="LibreSSL"
|
|
],[
|
|
AC_MSG_RESULT([no])
|
|
])
|
|
|
|
AC_MSG_CHECKING([for OpenSSL >= v3])
|
|
AC_COMPILE_IFELSE([
|
|
AC_LANG_PROGRAM([[
|
|
#include <openssl/opensslv.h>
|
|
]],[[
|
|
#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
|
|
return 0;
|
|
#else
|
|
#error older than 3
|
|
#endif
|
|
]])
|
|
],[
|
|
AC_MSG_RESULT([yes])
|
|
ssl_msg="OpenSSL v3+"
|
|
],[
|
|
AC_MSG_RESULT([no])
|
|
])
|
|
fi
|
|
|
|
dnl is this OpenSSL (fork) providing the original QUIC API?
|
|
AC_CHECK_FUNCS([SSL_set_quic_use_legacy_codepoint],
|
|
[QUIC_ENABLED=yes])
|
|
if test "$QUIC_ENABLED" = "yes"; then
|
|
AC_MSG_NOTICE([OpenSSL fork speaks QUIC API])
|
|
else
|
|
AC_MSG_NOTICE([OpenSSL version does not speak QUIC API])
|
|
fi
|
|
|
|
if test "$OPENSSL_ENABLED" = "1"; then
|
|
if test -n "$LIB_OPENSSL"; then
|
|
dnl when the ssl shared libs were found in a path that the run-time
|
|
dnl linker doesn't search through, we need to add it to CURL_LIBRARY_PATH
|
|
dnl to prevent further configure tests to fail due to this
|
|
if test "x$cross_compiling" != "xyes"; then
|
|
CURL_LIBRARY_PATH="$CURL_LIBRARY_PATH:$LIB_OPENSSL"
|
|
export CURL_LIBRARY_PATH
|
|
AC_MSG_NOTICE([Added $LIB_OPENSSL to CURL_LIBRARY_PATH])
|
|
fi
|
|
fi
|
|
check_for_ca_bundle=1
|
|
LIBCURL_PC_REQUIRES_PRIVATE="$LIBCURL_PC_REQUIRES_PRIVATE openssl"
|
|
fi
|
|
|
|
test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"
|
|
fi
|
|
|
|
if test X"$OPT_OPENSSL" != Xno &&
|
|
test "$OPENSSL_ENABLED" != "1"; then
|
|
AC_MSG_NOTICE([OPT_OPENSSL: $OPT_OPENSSL])
|
|
AC_MSG_NOTICE([OPENSSL_ENABLED: $OPENSSL_ENABLED])
|
|
AC_MSG_ERROR([--with-openssl was given but OpenSSL could not be detected])
|
|
fi
|
|
|
|
dnl ---
|
|
dnl We require OpenSSL with SRP support.
|
|
dnl ---
|
|
if test "$OPENSSL_ENABLED" = "1"; then
|
|
AC_MSG_CHECKING([for SRP support in OpenSSL])
|
|
AC_LINK_IFELSE([
|
|
AC_LANG_PROGRAM([[
|
|
#include <openssl/ssl.h>
|
|
]],[[
|
|
SSL_CTX_set_srp_username(NULL, "");
|
|
SSL_CTX_set_srp_password(NULL, "");
|
|
]])
|
|
],[
|
|
AC_MSG_RESULT([yes])
|
|
AC_DEFINE(HAVE_OPENSSL_SRP, 1, [if you have the functions SSL_CTX_set_srp_username and SSL_CTX_set_srp_password])
|
|
AC_SUBST(HAVE_OPENSSL_SRP, [1])
|
|
],[
|
|
AC_MSG_RESULT([no])
|
|
])
|
|
fi
|
|
|
|
dnl ---
|
|
dnl Whether the OpenSSL configuration will be loaded automatically
|
|
dnl ---
|
|
if test X"$OPENSSL_ENABLED" = X"1"; then
|
|
AC_ARG_ENABLE(openssl-auto-load-config,
|
|
AS_HELP_STRING([--enable-openssl-auto-load-config],[Enable automatic loading of OpenSSL configuration])
|
|
AS_HELP_STRING([--disable-openssl-auto-load-config],[Disable automatic loading of OpenSSL configuration]),
|
|
[ if test X"$enableval" = X"no"; then
|
|
AC_MSG_NOTICE([automatic loading of OpenSSL configuration disabled])
|
|
AC_DEFINE(CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG, 1, [if the OpenSSL configuration won't be loaded automatically])
|
|
fi
|
|
])
|
|
fi
|
|
|
|
dnl ---
|
|
dnl We may use OpenSSL QUIC.
|
|
dnl ---
|
|
if test "$OPENSSL_ENABLED" = "1"; then
|
|
AC_MSG_CHECKING([for QUIC support and OpenSSL >= 3.3])
|
|
AC_LINK_IFELSE([
|
|
AC_LANG_PROGRAM([[
|
|
#include <openssl/ssl.h>
|
|
]],[[
|
|
#if (OPENSSL_VERSION_NUMBER < 0x30300000L)
|
|
#error need at least version 3.3.0
|
|
#endif
|
|
OSSL_QUIC_client_method();
|
|
]])
|
|
],[
|
|
AC_MSG_RESULT([yes])
|
|
have_openssl_quic=1
|
|
],[
|
|
AC_MSG_RESULT([no])
|
|
])
|
|
fi
|
|
])
|