configure.ac

   1 AC_PREREQ([2.67])
   2 AC_INIT([cryptsetup],[2.6.1])
   3
   4 dnl library version from <major>.<minor>.<release>[-<suffix>]
   5 LIBCRYPTSETUP_VERSION=$(echo $PACKAGE_VERSION | cut -f1 -d-)
   6 LIBCRYPTSETUP_VERSION_INFO=21:0:9
   7
   8 AM_SILENT_RULES([yes])
   9 AC_CONFIG_SRCDIR(src/cryptsetup.c)
  10 AC_CONFIG_MACRO_DIR([m4])
  11
  12 AC_CONFIG_HEADERS([config.h:config.h.in])
  13
  14 # We do not want to run test in parallel. Really.
  15 # http://lists.gnu.org/archive/html/automake/2013-01/msg00060.html
  16
  17 # For old automake use this
  18 #AM_INIT_AUTOMAKE(dist-xz subdir-objects)
  19 AM_INIT_AUTOMAKE([dist-xz 1.12 serial-tests subdir-objects foreign])
  20
  21 if test "x$prefix" = "xNONE"; then
  22         sysconfdir=/etc
  23 fi
  24 AC_PREFIX_DEFAULT(/usr)
  25
  26 AC_CANONICAL_HOST
  27 AC_USE_SYSTEM_EXTENSIONS
  28 AC_PROG_CC
  29 AM_PROG_CC_C_O
  30 AC_PROG_CPP
  31 AC_PROG_CXX
  32 AC_PROG_INSTALL
  33 AC_PROG_MAKE_SET
  34 AC_PROG_MKDIR_P
  35 AC_ENABLE_STATIC(no)
  36 LT_INIT
  37 PKG_PROG_PKG_CONFIG
  38
  39 dnl ==========================================================================
  40 dnl define PKG_CHECK_VAR for old pkg-config <= 0.28
  41 m4_ifndef([AS_VAR_COPY],
  42 [m4_define([AS_VAR_COPY],
  43 [AS_LITERAL_IF([$1[]$2], [$1=$$2], [eval $1=\$$2])])
  44 ])
  45 m4_ifndef([PKG_CHECK_VAR], [
  46 AC_DEFUN([PKG_CHECK_VAR],
  47 [AC_REQUIRE([PKG_PROG_PKG_CONFIG])
  48 AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])
  49
  50 _PKG_CONFIG([$1], [variable="][$3]["], [$2])
  51 AS_VAR_COPY([$1], [pkg_cv_][$1])
  52
  53 AS_VAR_IF([$1], [""], [$5], [$4])
  54 ])
  55 ])
  56 dnl ==========================================================================
  57 dnl AsciiDoc manual pages
  58
  59 AC_ARG_ENABLE([asciidoc],
  60         AS_HELP_STRING([--disable-asciidoc], [do not generate man pages from asciidoc]),
  61         [], [enable_asciidoc=yes]
  62 )
  63
  64 AC_PATH_PROG([ASCIIDOCTOR], [asciidoctor])
  65 if test "x$enable_asciidoc" = xyes -a "x$ASCIIDOCTOR" = x; then
  66         AC_MSG_ERROR([Building man pages requires asciidoctor installed.])
  67 fi
  68 AM_CONDITIONAL([ENABLE_ASCIIDOC], [test "x$enable_asciidoc" = xyes])
  69
  70 have_manpages=no
  71 AS_IF([test -f "$srcdir/man/cryptsetup-open.8"], [
  72         AC_MSG_NOTICE([re-use already generated man-pages.])
  73         have_manpages=yes]
  74 )
  75 AM_CONDITIONAL([HAVE_MANPAGES], [test "x$have_manpages" = xyes])
  76
  77 dnl ==========================================================================
  78
  79 AC_C_RESTRICT
  80
  81 AC_HEADER_DIRENT
  82 AC_CHECK_HEADERS(fcntl.h malloc.h inttypes.h uchar.h sys/ioctl.h sys/mman.h \
  83         sys/sysmacros.h sys/statvfs.h ctype.h unistd.h locale.h byteswap.h endian.h stdint.h)
  84 AC_CHECK_DECLS([O_CLOEXEC],,[AC_DEFINE([O_CLOEXEC],[0], [Defined to 0 if not provided])],
  85 [[
  86 #ifdef HAVE_FCNTL_H
  87 # include <fcntl.h>
  88 #endif
  89 ]])
  90
  91 AC_CHECK_HEADERS(uuid/uuid.h,,[AC_MSG_ERROR([You need the uuid library.])])
  92 AC_CHECK_HEADER(libdevmapper.h,,[AC_MSG_ERROR([You need the device-mapper library.])])
  93
  94 AC_ARG_ENABLE([keyring],
  95         AS_HELP_STRING([--disable-keyring], [disable kernel keyring support and builtin kernel keyring token]),
  96         [], [enable_keyring=yes])
  97 if test "x$enable_keyring" = "xyes"; then
  98         AC_CHECK_HEADERS(linux/keyctl.h,,[AC_MSG_ERROR([You need Linux kernel headers with kernel keyring service compiled.])])
  99
 100         dnl ==========================================================================
 101         dnl check whether kernel is compiled with kernel keyring service syscalls
 102         AC_CHECK_DECL(__NR_add_key,,[AC_MSG_ERROR([The kernel is missing add_key syscall.])], [#include <syscall.h>])
 103         AC_CHECK_DECL(__NR_keyctl,,[AC_MSG_ERROR([The kernel is missing keyctl syscall.])], [#include <syscall.h>])
 104         AC_CHECK_DECL(__NR_request_key,,[AC_MSG_ERROR([The kernel is missing request_key syscall.])], [#include <syscall.h>])
 105
 106         dnl ==========================================================================
 107         dnl check that key_serial_t hasn't been adopted yet in stdlib
 108         AC_CHECK_TYPES([key_serial_t], [], [], [
 109         AC_INCLUDES_DEFAULT
 110         #ifdef HAVE_LINUX_KEYCTL_H
 111         # include <linux/keyctl.h>
 112         #endif
 113         ])
 114
 115         AC_DEFINE(KERNEL_KEYRING, 1, [Enable kernel keyring service support])
 116 fi
 117 AM_CONDITIONAL(KERNEL_KEYRING, test "x$enable_keyring" = "xyes")
 118
 119 saved_LIBS=$LIBS
 120 AC_CHECK_LIB(uuid, uuid_clear, ,[AC_MSG_ERROR([You need the uuid library.])])
 121 AC_SUBST(UUID_LIBS, $LIBS)
 122 LIBS=$saved_LIBS
 123
 124 AC_SEARCH_LIBS([clock_gettime],[rt posix4])
 125 AC_CHECK_FUNCS([posix_memalign clock_gettime posix_fallocate explicit_bzero])
 126
 127 if test "x$enable_largefile" = "xno"; then
 128   AC_MSG_ERROR([Building with --disable-largefile is not supported, it can cause data corruption.])
 129 fi
 130
 131 AC_C_CONST
 132 AC_C_BIGENDIAN
 133 AC_TYPE_OFF_T
 134 AC_SYS_LARGEFILE
 135 AC_FUNC_FSEEKO
 136 AC_PROG_GCC_TRADITIONAL
 137 AC_FUNC_STRERROR_R
 138
 139 dnl ==========================================================================
 140 dnl LUKS2 external tokens
 141
 142 AC_ARG_ENABLE([external-tokens],
 143         AS_HELP_STRING([--disable-external-tokens], [disable external LUKS2 tokens]),
 144         [], [enable_external_tokens=yes])
 145 if test "x$enable_external_tokens" = "xyes"; then
 146         AC_DEFINE(USE_EXTERNAL_TOKENS, 1, [Use external tokens])
 147         dnl we need dynamic library loading here
 148         saved_LIBS=$LIBS
 149         AC_SEARCH_LIBS([dlsym],[dl])
 150         AC_CHECK_FUNCS([dlvsym])
 151         AC_SUBST(DL_LIBS, $LIBS)
 152         LIBS=$saved_LIBS
 153 fi
 154 AM_CONDITIONAL(EXTERNAL_TOKENS, test "x$enable_external_tokens" = "xyes")
 155
 156 AC_ARG_ENABLE([ssh-token],
 157         AS_HELP_STRING([--disable-ssh-token], [disable LUKS2 ssh-token]),
 158         [], [enable_ssh_token=yes])
 159 AM_CONDITIONAL(SSHPLUGIN_TOKEN, test "x$enable_ssh_token" = "xyes")
 160
 161 if test "x$enable_ssh_token" = "xyes" -a "x$enable_external_tokens" = "xno"; then
 162         AC_MSG_ERROR([Requested LUKS2 ssh-token build, but external tokens are disabled.])
 163 fi
 164
 165 dnl LUKS2 online reencryption
 166 AC_ARG_ENABLE([luks2-reencryption],
 167         AS_HELP_STRING([--disable-luks2-reencryption], [disable LUKS2 online reencryption extension]),
 168         [], [enable_luks2_reencryption=yes])
 169 if test "x$enable_luks2_reencryption" = "xyes"; then
 170         AC_DEFINE(USE_LUKS2_REENCRYPTION, 1, [Use LUKS2 online reencryption extension])
 171 fi
 172
 173 dnl ==========================================================================
 174
 175 AM_GNU_GETTEXT([external],[need-ngettext])
 176 AM_GNU_GETTEXT_VERSION([0.18.3])
 177
 178 dnl ==========================================================================
 179
 180 saved_LIBS=$LIBS
 181 AC_CHECK_LIB(popt, poptConfigFileToString,,
 182         [AC_MSG_ERROR([You need popt 1.7 or newer to compile.])])
 183 AC_SUBST(POPT_LIBS, $LIBS)
 184 LIBS=$saved_LIBS
 185
 186 dnl ==========================================================================
 187 dnl FIPS extensions
 188 AC_ARG_ENABLE([fips],
 189         AS_HELP_STRING([--enable-fips], [enable FIPS mode restrictions]))
 190 if test "x$enable_fips" = "xyes"; then
 191         AC_DEFINE(ENABLE_FIPS, 1, [Enable FIPS mode restrictions])
 192
 193         if test "x$enable_static" = "xyes" -o "x$enable_static_cryptsetup" = "xyes" ; then
 194                 AC_MSG_ERROR([Static build is not compatible with FIPS.])
 195         fi
 196 fi
 197
 198 AC_DEFUN([NO_FIPS], [
 199         if test "x$enable_fips" = "xyes"; then
 200                 AC_MSG_ERROR([This option is not compatible with FIPS.])
 201         fi
 202 ])
 203
 204 dnl ==========================================================================
 205 dnl pwquality library (cryptsetup CLI only)
 206 AC_ARG_ENABLE([pwquality],
 207         AS_HELP_STRING([--enable-pwquality], [enable password quality checking using pwquality library]))
 208
 209 if test "x$enable_pwquality" = "xyes"; then
 210         AC_DEFINE(ENABLE_PWQUALITY, 1, [Enable password quality checking using pwquality library])
 211         PKG_CHECK_MODULES([PWQUALITY], [pwquality >= 1.0.0],,
 212                 AC_MSG_ERROR([You need pwquality library.]))
 213
 214         dnl FIXME: this is really hack for now
 215         PWQUALITY_STATIC_LIBS="$PWQUALITY_LIBS -lcrack -lz"
 216 fi
 217
 218 dnl ==========================================================================
 219 dnl fuzzers, it requires own static library compilation later
 220 AC_ARG_ENABLE([fuzz-targets],
 221         AS_HELP_STRING([--enable-fuzz-targets], [enable building fuzz targets]))
 222 AM_CONDITIONAL(ENABLE_FUZZ_TARGETS, test "x$enable_fuzz_targets" = "xyes")
 223
 224 if test "x$enable_fuzz_targets" = "xyes"; then
 225         AX_CHECK_COMPILE_FLAG([-fsanitize=fuzzer-no-link],,
 226                 AC_MSG_ERROR([Required compiler options not supported; use clang.]), [-Werror])
 227 fi
 228
 229 dnl ==========================================================================
 230 dnl passwdqc library (cryptsetup CLI only)
 231 AC_ARG_ENABLE([passwdqc],
 232         AS_HELP_STRING([--enable-passwdqc@<:@=CONFIG_PATH@:>@],
 233                        [enable password quality checking using passwdqc library (optionally with CONFIG_PATH)]))
 234
 235 case "$enable_passwdqc" in
 236         ""|yes|no) use_passwdqc_config="" ;;
 237         /*) use_passwdqc_config="$enable_passwdqc"; enable_passwdqc=yes ;;
 238         *) AC_MSG_ERROR([Unrecognized --enable-passwdqc parameter.]) ;;
 239 esac
 240 AC_DEFINE_UNQUOTED([PASSWDQC_CONFIG_FILE], ["$use_passwdqc_config"], [passwdqc library config file])
 241
 242 if test "x$enable_passwdqc" = "xyes"; then
 243         AC_DEFINE(ENABLE_PASSWDQC, 1, [Enable password quality checking using passwdqc library])
 244
 245         saved_LIBS="$LIBS"
 246         AC_SEARCH_LIBS([passwdqc_check], [passwdqc])
 247         case "$ac_cv_search_passwdqc_check" in
 248                 no) AC_MSG_ERROR([failed to find passwdqc_check]) ;;
 249                 -l*) PASSWDQC_LIBS="$ac_cv_search_passwdqc_check" ;;
 250                 *) PASSWDQC_LIBS= ;;
 251         esac
 252         AC_CHECK_FUNCS([passwdqc_params_free])
 253         LIBS="$saved_LIBS"
 254 fi
 255
 256 if test "x$enable_pwquality$enable_passwdqc" = "xyesyes"; then
 257         AC_MSG_ERROR([--enable-pwquality and --enable-passwdqc are mutually incompatible.])
 258 fi
 259
 260 dnl ==========================================================================
 261 dnl Crypto backend functions
 262
 263 AC_DEFUN([CONFIGURE_GCRYPT], [
 264         if test "x$enable_fips" = "xyes"; then
 265                 GCRYPT_REQ_VERSION=1.4.5
 266         else
 267                 GCRYPT_REQ_VERSION=1.1.42
 268         fi
 269
 270         dnl libgcrypt rejects to use pkgconfig, use AM_PATH_LIBGCRYPT from gcrypt-devel here.
 271         dnl Do not require gcrypt-devel if other crypto backend is used.
 272         m4_ifdef([AM_PATH_LIBGCRYPT],[
 273         AC_ARG_ENABLE([gcrypt-pbkdf2],
 274                 dnl Check if we can use gcrypt PBKDF2 (1.6.0 supports empty password)
 275                 AS_HELP_STRING([--enable-gcrypt-pbkdf2], [force enable internal gcrypt PBKDF2]),
 276                 if test "x$enableval" = "xyes"; then
 277                         [use_internal_pbkdf2=0]
 278                 else
 279                         [use_internal_pbkdf2=1]
 280                 fi,
 281                 [AM_PATH_LIBGCRYPT([1.6.1], [use_internal_pbkdf2=0], [use_internal_pbkdf2=1])])
 282         AM_PATH_LIBGCRYPT($GCRYPT_REQ_VERSION,,[AC_MSG_ERROR([You need the gcrypt library.])])],
 283         AC_MSG_ERROR([Missing support for gcrypt: install gcrypt and regenerate configure.]))
 284
 285         AC_MSG_CHECKING([if internal cryptsetup PBKDF2 is compiled-in])
 286         if test $use_internal_pbkdf2 = 0; then
 287                 AC_MSG_RESULT([no])
 288         else
 289                 AC_MSG_RESULT([yes])
 290                 NO_FIPS([])
 291         fi
 292
 293         AC_CHECK_DECLS([GCRY_CIPHER_MODE_XTS], [], [], [#include <gcrypt.h>])
 294
 295         if test "x$enable_static_cryptsetup" = "xyes"; then
 296                 saved_LIBS=$LIBS
 297                 LIBS="$saved_LIBS $LIBGCRYPT_LIBS -static"
 298                 AC_CHECK_LIB(gcrypt, gcry_check_version,,
 299                         AC_MSG_ERROR([Cannot find static gcrypt library.]),
 300                         [-lgpg-error])
 301                 LIBGCRYPT_STATIC_LIBS="$LIBGCRYPT_LIBS -lgpg-error"
 302                 LIBS=$saved_LIBS
 303         fi
 304
 305         CRYPTO_CFLAGS=$LIBGCRYPT_CFLAGS
 306         CRYPTO_LIBS=$LIBGCRYPT_LIBS
 307         CRYPTO_STATIC_LIBS=$LIBGCRYPT_STATIC_LIBS
 308
 309         AC_DEFINE_UNQUOTED(GCRYPT_REQ_VERSION, ["$GCRYPT_REQ_VERSION"], [Requested gcrypt version])
 310 ])
 311
 312 AC_DEFUN([CONFIGURE_OPENSSL], [
 313         PKG_CHECK_MODULES([OPENSSL], [openssl3 >= 3.0.9],,
 314                 AC_MSG_ERROR([You need openssl library.]))
 315         CRYPTO_CFLAGS=$OPENSSL_CFLAGS
 316         CRYPTO_LIBS=$OPENSSL_LIBS
 317         use_internal_pbkdf2=0
 318
 319         if test "x$enable_static_cryptsetup" = "xyes"; then
 320                 saved_PKG_CONFIG=$PKG_CONFIG
 321                 PKG_CONFIG="$PKG_CONFIG --static"
 322                 PKG_CHECK_MODULES([OPENSSL_STATIC], [openssl])
 323                 CRYPTO_STATIC_LIBS=$OPENSSL_STATIC_LIBS
 324                 PKG_CONFIG=$saved_PKG_CONFIG
 325         fi
 326 ])
 327
 328 AC_DEFUN([CONFIGURE_NSS], [
 329         if test "x$enable_static_cryptsetup" = "xyes"; then
 330                 AC_MSG_ERROR([Static build of cryptsetup is not supported with NSS.])
 331         fi
 332
 333         AC_MSG_WARN([NSS backend does NOT provide backward compatibility (missing ripemd160 hash).])
 334
 335         PKG_CHECK_MODULES([NSS], [nss],,
 336                 AC_MSG_ERROR([You need nss library.]))
 337
 338         saved_CFLAGS=$CFLAGS
 339         CFLAGS="$CFLAGS $NSS_CFLAGS"
 340         AC_CHECK_DECLS([NSS_GetVersion], [], [], [#include <nss.h>])
 341         CFLAGS=$saved_CFLAGS
 342
 343         CRYPTO_CFLAGS=$NSS_CFLAGS
 344         CRYPTO_LIBS=$NSS_LIBS
 345         use_internal_pbkdf2=1
 346         NO_FIPS([])
 347 ])
 348
 349 AC_DEFUN([CONFIGURE_KERNEL], [
 350         AC_CHECK_HEADERS(linux/if_alg.h,,
 351                 [AC_MSG_ERROR([You need Linux kernel headers with userspace crypto interface.])])
 352 #       AC_CHECK_DECLS([AF_ALG],,
 353 #               [AC_MSG_ERROR([You need Linux kernel with userspace crypto interface.])],
 354 #               [#include <sys/socket.h>])
 355         use_internal_pbkdf2=1
 356         NO_FIPS([])
 357 ])
 358
 359 AC_DEFUN([CONFIGURE_NETTLE], [
 360         AC_CHECK_HEADERS(nettle/sha.h,,
 361                 [AC_MSG_ERROR([You need Nettle cryptographic library.])])
 362         AC_CHECK_HEADERS(nettle/version.h)
 363
 364         saved_LIBS=$LIBS
 365         AC_CHECK_LIB(nettle, nettle_pbkdf2_hmac_sha256,,
 366                 [AC_MSG_ERROR([You need Nettle library version 2.6 or more recent.])])
 367         CRYPTO_LIBS=$LIBS
 368         LIBS=$saved_LIBS
 369
 370         CRYPTO_STATIC_LIBS=$CRYPTO_LIBS
 371         use_internal_pbkdf2=0
 372         NO_FIPS([])
 373 ])
 374
 375 dnl ==========================================================================
 376 saved_LIBS=$LIBS
 377
 378 AC_ARG_ENABLE([static-cryptsetup],
 379         AS_HELP_STRING([--enable-static-cryptsetup], [enable build of static version of tools]))
 380 if test "x$enable_static_cryptsetup" = "xyes"; then
 381         if test "x$enable_static" = "xno"; then
 382                 AC_MSG_WARN([Requested static cryptsetup build, enabling static library.])
 383                 enable_static=yes
 384         fi
 385 fi
 386 AM_CONDITIONAL(STATIC_TOOLS, test "x$enable_static_cryptsetup" = "xyes")
 387
 388 AC_ARG_ENABLE([cryptsetup],
 389         AS_HELP_STRING([--disable-cryptsetup], [disable cryptsetup support]),
 390         [], [enable_cryptsetup=yes])
 391 AM_CONDITIONAL(CRYPTSETUP, test "x$enable_cryptsetup" = "xyes")
 392
 393 AC_ARG_ENABLE([veritysetup],
 394         AS_HELP_STRING([--disable-veritysetup], [disable veritysetup support]),
 395         [], [enable_veritysetup=yes])
 396 AM_CONDITIONAL(VERITYSETUP, test "x$enable_veritysetup" = "xyes")
 397
 398 AC_ARG_ENABLE([integritysetup],
 399         AS_HELP_STRING([--disable-integritysetup], [disable integritysetup support]),
 400         [], [enable_integritysetup=yes])
 401 AM_CONDITIONAL(INTEGRITYSETUP, test "x$enable_integritysetup" = "xyes")
 402
 403 AC_ARG_ENABLE([selinux],
 404         AS_HELP_STRING([--disable-selinux], [disable selinux support [default=auto]]),
 405         [], [enable_selinux=yes])
 406
 407 AC_ARG_ENABLE([udev],
 408         AS_HELP_STRING([--disable-udev], [disable udev support]),
 409         [], [enable_udev=yes])
 410
 411 dnl Try to use pkg-config for devmapper, but fallback to old detection
 412 PKG_CHECK_MODULES([DEVMAPPER], [devmapper >= 1.02.03],, [
 413         AC_CHECK_LIB(devmapper, dm_task_set_name,,
 414                 [AC_MSG_ERROR([You need the device-mapper library.])])
 415         AC_CHECK_LIB(devmapper, dm_task_set_message,,
 416                 [AC_MSG_ERROR([The device-mapper library on your system is too old.])])
 417         DEVMAPPER_LIBS=$LIBS
 418 ])
 419 LIBS=$saved_LIBS
 420
 421 LIBS="$LIBS $DEVMAPPER_LIBS"
 422 AC_CHECK_DECLS([dm_task_secure_data], [], [], [#include <libdevmapper.h>])
 423 AC_CHECK_DECLS([dm_task_retry_remove], [], [], [#include <libdevmapper.h>])
 424 AC_CHECK_DECLS([dm_task_deferred_remove], [], [], [#include <libdevmapper.h>])
 425 AC_CHECK_DECLS([dm_device_has_mounted_fs], [], [], [#include <libdevmapper.h>])
 426 AC_CHECK_DECLS([dm_device_has_holders], [], [], [#include <libdevmapper.h>])
 427 AC_CHECK_DECLS([dm_device_get_name], [], [], [#include <libdevmapper.h>])
 428 AC_CHECK_DECLS([DM_DEVICE_GET_TARGET_VERSION], [], [], [#include <libdevmapper.h>])
 429 AC_CHECK_DECLS([DM_UDEV_DISABLE_DISK_RULES_FLAG], [have_cookie=yes], [have_cookie=no], [#include <libdevmapper.h>])
 430 if test "x$enable_udev" = xyes; then
 431         if test "x$have_cookie" = xno; then
 432                 AC_MSG_WARN([The device-mapper library on your system has no udev support, udev support disabled.])
 433         else
 434                 AC_DEFINE(USE_UDEV, 1, [Try to use udev synchronisation?])
 435         fi
 436 fi
 437 LIBS=$saved_LIBS
 438
 439 dnl Check for JSON-C used in LUKS2
 440 PKG_CHECK_MODULES([JSON_C], [json-c])
 441 AC_CHECK_DECLS([json_object_object_add_ex], [], [], [#include <json-c/json.h>])
 442 AC_CHECK_DECLS([json_object_deep_copy], [], [], [#include <json-c/json.h>])
 443
 444 dnl Check for libssh and argp for SSH plugin
 445 if test "x$enable_ssh_token" = "xyes"; then
 446         PKG_CHECK_MODULES([LIBSSH], [libssh])
 447         AC_CHECK_DECLS([ssh_session_is_known_server], [], [], [#include <libssh/libssh.h>])
 448         AC_CHECK_HEADER([argp.h], [], AC_MSG_ERROR([You need argp library.]))
 449         saved_LIBS=$LIBS
 450         AC_SEARCH_LIBS([argp_parse],[argp])
 451         AC_SUBST(ARGP_LIBS, $LIBS)
 452         LIBS=$saved_LIBS
 453 fi
 454
 455 dnl Crypto backend configuration.
 456 AC_ARG_WITH([crypto_backend],
 457         AS_HELP_STRING([--with-crypto_backend=BACKEND], [crypto backend (gcrypt/openssl/nss/kernel/nettle) [openssl]]),
 458         [], [with_crypto_backend=openssl])
 459
 460 dnl Kernel crypto API backend needed for benchmark and tcrypt
 461 AC_ARG_ENABLE([kernel_crypto],
 462         AS_HELP_STRING([--disable-kernel_crypto], [disable kernel userspace crypto (no benchmark and tcrypt)]),
 463         [], [enable_kernel_crypto=yes])
 464
 465 if test "x$enable_kernel_crypto" = "xyes"; then
 466         AC_CHECK_HEADERS(linux/if_alg.h,,
 467                 [AC_MSG_ERROR([You need Linux kernel headers with userspace crypto interface. (Or use --disable-kernel_crypto.)])])
 468         AC_DEFINE(ENABLE_AF_ALG, 1, [Enable using of kernel userspace crypto])
 469 fi
 470
 471 case $with_crypto_backend in
 472         gcrypt)  CONFIGURE_GCRYPT([]) ;;
 473         openssl) CONFIGURE_OPENSSL([]) ;;
 474         nss)     CONFIGURE_NSS([]) ;;
 475         kernel)  CONFIGURE_KERNEL([]) ;;
 476         nettle)  CONFIGURE_NETTLE([]) ;;
 477         *) AC_MSG_ERROR([Unknown crypto backend.]) ;;
 478 esac
 479 AM_CONDITIONAL(CRYPTO_BACKEND_GCRYPT,  test "$with_crypto_backend" = "gcrypt")
 480 AM_CONDITIONAL(CRYPTO_BACKEND_OPENSSL, test "$with_crypto_backend" = "openssl")
 481 AM_CONDITIONAL(CRYPTO_BACKEND_NSS,     test "$with_crypto_backend" = "nss")
 482 AM_CONDITIONAL(CRYPTO_BACKEND_KERNEL,  test "$with_crypto_backend" = "kernel")
 483 AM_CONDITIONAL(CRYPTO_BACKEND_NETTLE,  test "$with_crypto_backend" = "nettle")
 484
 485 AM_CONDITIONAL(CRYPTO_INTERNAL_PBKDF2, test $use_internal_pbkdf2 = 1)
 486 AC_DEFINE_UNQUOTED(USE_INTERNAL_PBKDF2, [$use_internal_pbkdf2], [Use internal PBKDF2])
 487
 488 dnl Argon2 implementation
 489 AC_ARG_ENABLE([internal-argon2],
 490         AS_HELP_STRING([--disable-internal-argon2], [disable internal implementation of Argon2 PBKDF]),
 491         [], [enable_internal_argon2=yes])
 492
 493 AC_ARG_ENABLE([libargon2],
 494         AS_HELP_STRING([--enable-libargon2], [enable external libargon2 (PHC) library (disables internal bundled version)]))
 495
 496 if test "x$enable_libargon2" = "xyes" ; then
 497         AC_CHECK_HEADERS(argon2.h,,
 498                 [AC_MSG_ERROR([You need libargon2 development library installed.])])
 499         AC_CHECK_DECL(Argon2_id,,[AC_MSG_ERROR([You need more recent Argon2 library with support for Argon2id.])], [#include <argon2.h>])
 500         PKG_CHECK_MODULES([LIBARGON2], [libargon2],,[LIBARGON2_LIBS="-largon2"])
 501         enable_internal_argon2=no
 502 else
 503         AC_MSG_WARN([Argon2 bundled (slow) reference implementation will be used, please consider to use system library with --enable-libargon2.])
 504
 505         AC_ARG_ENABLE([internal-sse-argon2],
 506                 AS_HELP_STRING([--enable-internal-sse-argon2], [enable internal SSE implementation of Argon2 PBKDF]))
 507
 508         if test "x$enable_internal_sse_argon2" = "xyes"; then
 509                 AC_MSG_CHECKING(if Argon2 SSE optimization can be used)
 510                 AC_LINK_IFELSE([AC_LANG_PROGRAM([[
 511                         #include <emmintrin.h>
 512                         __m128i testfunc(__m128i *a, __m128i *b) {
 513                           return _mm_xor_si128(_mm_loadu_si128(a), _mm_loadu_si128(b));
 514                         }
 515                 ]])],,[enable_internal_sse_argon2=no])
 516                 AC_MSG_RESULT($enable_internal_sse_argon2)
 517         fi
 518 fi
 519
 520 if test "x$enable_internal_argon2" = "xyes"; then
 521         AC_DEFINE(USE_INTERNAL_ARGON2, 1, [Use internal Argon2])
 522 fi
 523 AM_CONDITIONAL(CRYPTO_INTERNAL_ARGON2, test "x$enable_internal_argon2" = "xyes")
 524 AM_CONDITIONAL(CRYPTO_INTERNAL_SSE_ARGON2, test "x$enable_internal_sse_argon2" = "xyes")
 525
 526 dnl Link with blkid to check for other device types
 527 AC_ARG_ENABLE([blkid],
 528         AS_HELP_STRING([--disable-blkid], [disable use of blkid for device signature detection and wiping]),
 529         [], [enable_blkid=yes])
 530
 531 if test "x$enable_blkid" = "xyes"; then
 532         PKG_CHECK_MODULES([BLKID], [blkid],[AC_DEFINE([HAVE_BLKID], 1, [Define to 1 to use blkid for detection of disk signatures.])],[LIBBLKID_LIBS="-lblkid"])
 533
 534         AC_CHECK_HEADERS(blkid/blkid.h,,[AC_MSG_ERROR([You need blkid development library installed.])])
 535         AC_CHECK_DECL([blkid_do_wipe],
 536                       [ AC_DEFINE([HAVE_BLKID_WIPE], 1, [Define to 1 to use blkid_do_wipe.])
 537                         enable_blkid_wipe=yes
 538                       ],,
 539                       [#include <blkid/blkid.h>])
 540         AC_CHECK_DECL([blkid_probe_step_back],
 541                       [ AC_DEFINE([HAVE_BLKID_STEP_BACK], 1, [Define to 1 to use blkid_probe_step_back.])
 542                         enable_blkid_step_back=yes
 543                       ],,
 544                       [#include <blkid/blkid.h>])
 545         AC_CHECK_DECLS([ blkid_reset_probe,
 546                          blkid_probe_set_device,
 547                          blkid_probe_filter_superblocks_type,
 548                          blkid_do_safeprobe,
 549                          blkid_do_probe,
 550                          blkid_probe_lookup_value
 551                        ],,
 552                        [AC_MSG_ERROR([Can not compile with blkid support, disable it by --disable-blkid.])],
 553                        [#include <blkid/blkid.h>])
 554 fi
 555 AM_CONDITIONAL(HAVE_BLKID, test "x$enable_blkid" = "xyes")
 556 AM_CONDITIONAL(HAVE_BLKID_WIPE, test "x$enable_blkid_wipe" = "xyes")
 557 AM_CONDITIONAL(HAVE_BLKID_STEP_BACK, test "x$enable_blkid_step_back" = "xyes")
 558
 559 dnl Magic for cryptsetup.static build.
 560 if test "x$enable_static_cryptsetup" = "xyes"; then
 561         saved_PKG_CONFIG=$PKG_CONFIG
 562         PKG_CONFIG="$PKG_CONFIG --static"
 563
 564         LIBS="$saved_LIBS -static"
 565         AC_CHECK_LIB(popt, poptGetContext,,
 566                 AC_MSG_ERROR([Cannot find static popt library.]))
 567
 568         dnl Try to detect needed device-mapper static libraries, try pkg-config first.
 569         LIBS="$saved_LIBS -static"
 570         PKG_CHECK_MODULES([DEVMAPPER_STATIC], [devmapper >= 1.02.27],,[
 571                 DEVMAPPER_STATIC_LIBS=$DEVMAPPER_LIBS
 572                 if test "x$enable_selinux" = "xyes"; then
 573                         AC_CHECK_LIB(sepol, sepol_bool_set)
 574                         AC_CHECK_LIB(selinux, is_selinux_enabled)
 575                         DEVMAPPER_STATIC_LIBS="$DEVMAPPER_STATIC_LIBS $LIBS"
 576                 fi
 577         ])
 578         LIBS="$saved_LIBS $DEVMAPPER_STATIC_LIBS"
 579         AC_CHECK_LIB(devmapper, dm_task_set_uuid,,
 580                 AC_MSG_ERROR([Cannot link with static device-mapper library.]))
 581
 582         dnl Try to detect uuid static library.
 583         LIBS="$saved_LIBS -static"
 584         AC_CHECK_LIB(uuid, uuid_generate,,
 585                 AC_MSG_ERROR([Cannot find static uuid library.]))
 586
 587         LIBS=$saved_LIBS
 588         PKG_CONFIG=$saved_PKG_CONFIG
 589 fi
 590
 591 dnl Check compiler support for symver function attribute
 592 AC_MSG_CHECKING([for symver attribute support])
 593 saved_CFLAGS=$CFLAGS
 594 CFLAGS="-O0 -Werror"
 595 AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[
 596         void _test_sym(void);
 597         __attribute__((__symver__("sym@VERSION_4.2"))) void _test_sym(void) {}
 598 ]],
 599 [[ _test_sym() ]]
 600 )],[
 601         AC_DEFINE([HAVE_ATTRIBUTE_SYMVER], 1, [Define to 1 to use __attribute__((symver))])
 602         AC_MSG_RESULT([yes])
 603 ], [
 604         AC_MSG_RESULT([no])
 605 ])
 606 CFLAGS=$saved_CFLAGS
 607
 608 AC_MSG_CHECKING([for systemd tmpfiles config directory])
 609 PKG_CHECK_VAR([systemd_tmpfilesdir], [systemd], [tmpfilesdir], [], [systemd_tmpfilesdir=no])
 610 AC_MSG_RESULT([$systemd_tmpfilesdir])
 611
 612 AC_SUBST([DEVMAPPER_LIBS])
 613 AC_SUBST([DEVMAPPER_STATIC_LIBS])
 614
 615 AC_SUBST([PWQUALITY_LIBS])
 616 AC_SUBST([PWQUALITY_STATIC_LIBS])
 617
 618 AC_SUBST([PASSWDQC_LIBS])
 619
 620 AC_SUBST([CRYPTO_CFLAGS])
 621 AC_SUBST([CRYPTO_LIBS])
 622 AC_SUBST([CRYPTO_STATIC_LIBS])
 623
 624 AC_SUBST([JSON_C_LIBS])
 625 AC_SUBST([LIBARGON2_LIBS])
 626 AC_SUBST([BLKID_LIBS])
 627
 628 AC_SUBST([LIBSSH_LIBS])
 629
 630 AC_SUBST([LIBCRYPTSETUP_VERSION])
 631 AC_SUBST([LIBCRYPTSETUP_VERSION_INFO])
 632
 633 dnl Set Requires.private for libcryptsetup.pc
 634 dnl pwquality is used only by tools
 635 PKGMODULES="uuid devmapper json-c"
 636 case $with_crypto_backend in
 637         gcrypt)  PKGMODULES+=" libgcrypt" ;;
 638         openssl) PKGMODULES+=" openssl" ;;
 639         nss)     PKGMODULES+=" nss" ;;
 640         nettle)  PKGMODULES+=" nettle" ;;
 641 esac
 642 if test "x$enable_libargon2" = "xyes"; then
 643         PKGMODULES+=" libargon2"
 644 fi
 645 if test "x$enable_blkid" = "xyes"; then
 646         PKGMODULES+=" blkid"
 647 fi
 648 AC_SUBST([PKGMODULES])
 649 dnl ==========================================================================
 650 AC_ARG_ENABLE([dev-random],
 651         AS_HELP_STRING([--enable-dev-random], [use /dev/random by default for key generation (otherwise use /dev/urandom)]))
 652 if test "x$enable_dev_random" = "xyes"; then
 653         default_rng=/dev/random
 654 else
 655         default_rng=/dev/urandom
 656 fi
 657 AC_DEFINE_UNQUOTED(DEFAULT_RNG, ["$default_rng"], [default RNG type for key generator])
 658
 659 dnl ==========================================================================
 660 AC_DEFUN([CS_DEFINE],
 661         [AC_DEFINE_UNQUOTED(DEFAULT_[]m4_translit([$1], [-a-z], [_A-Z]), [$2], [$3])
 662 ])
 663
 664 AC_DEFUN([CS_STR_WITH], [AC_ARG_WITH([$1],
 665         [AS_HELP_STRING(--with-[$1], [default $2 [$3]])],
 666         [CS_DEFINE([$1], ["$withval"], [$2])],
 667         [CS_DEFINE([$1], ["$3"], [$2])]
 668 )])
 669
 670 AC_DEFUN([CS_NUM_WITH], [AC_ARG_WITH([$1],
 671         [AS_HELP_STRING(--with-[$1], [default $2 [$3]])],
 672         [CS_DEFINE([$1], [$withval], [$2])],
 673         [CS_DEFINE([$1], [$3], [$2])]
 674 )])
 675
 676 AC_DEFUN([CS_ABSPATH], [
 677         case "$1" in
 678                 /*) ;;
 679                 *) AC_MSG_ERROR([$2 argument must be an absolute path.]);;
 680         esac
 681 ])
 682
 683 dnl ==========================================================================
 684 CS_STR_WITH([plain-hash],   [password hashing function for plain mode], [ripemd160])
 685 CS_STR_WITH([plain-cipher], [cipher for plain mode], [aes])
 686 CS_STR_WITH([plain-mode],   [cipher mode for plain mode], [cbc-essiv:sha256])
 687 CS_NUM_WITH([plain-keybits],[key length in bits for plain mode], [256])
 688
 689 CS_STR_WITH([luks1-hash],   [hash function for LUKS1 header], [sha256])
 690 CS_STR_WITH([luks1-cipher], [cipher for LUKS1], [aes])
 691 CS_STR_WITH([luks1-mode],   [cipher mode for LUKS1], [xts-plain64])
 692 CS_NUM_WITH([luks1-keybits],[key length in bits for LUKS1], [256])
 693
 694 AC_ARG_ENABLE([luks_adjust_xts_keysize], AS_HELP_STRING([--disable-luks-adjust-xts-keysize],
 695         [XTS mode requires two keys, double default LUKS keysize if needed]),
 696         [], [enable_luks_adjust_xts_keysize=yes])
 697 if test "x$enable_luks_adjust_xts_keysize" = "xyes"; then
 698         AC_DEFINE(ENABLE_LUKS_ADJUST_XTS_KEYSIZE, 1, [XTS mode - double default LUKS keysize if needed])
 699 fi
 700
 701 CS_STR_WITH([luks2-pbkdf],           [Default PBKDF algorithm (pbkdf2 or argon2i/argon2id) for LUKS2], [argon2id])
 702 CS_NUM_WITH([luks1-iter-time],       [PBKDF2 iteration time for LUKS1 (in ms)], [2000])
 703 CS_NUM_WITH([luks2-iter-time],       [Argon2 PBKDF iteration time for LUKS2 (in ms)], [2000])
 704 CS_NUM_WITH([luks2-memory-kb],       [Argon2 PBKDF memory cost for LUKS2 (in kB)], [1048576])
 705 CS_NUM_WITH([luks2-parallel-threads],[Argon2 PBKDF max parallel cost for LUKS2 (if CPUs available)], [4])
 706
 707 CS_STR_WITH([luks2-keyslot-cipher], [fallback cipher for LUKS2 keyslot (if data encryption is incompatible)], [aes-xts-plain64])
 708 CS_NUM_WITH([luks2-keyslot-keybits],[fallback key size for LUKS2 keyslot (if data encryption is incompatible)], [512])
 709
 710 CS_STR_WITH([loopaes-cipher], [cipher for loop-AES mode], [aes])
 711 CS_NUM_WITH([loopaes-keybits],[key length in bits for loop-AES mode], [256])
 712
 713 CS_NUM_WITH([keyfile-size-maxkb],[maximum keyfile size (in KiB)], [8192])
 714 CS_NUM_WITH([integrity-keyfile-size-maxkb],[maximum integritysetup keyfile size (in KiB)], [4])
 715 CS_NUM_WITH([passphrase-size-max],[maximum passphrase size (in characters)], [512])
 716
 717 CS_STR_WITH([verity-hash],       [hash function for verity mode], [sha256])
 718 CS_NUM_WITH([verity-data-block], [data block size for verity mode], [4096])
 719 CS_NUM_WITH([verity-hash-block], [hash block size for verity mode], [4096])
 720 CS_NUM_WITH([verity-salt-size],  [salt size for verity mode], [32])
 721 CS_NUM_WITH([verity-fec-roots],  [parity bytes for verity FEC], [2])
 722
 723 CS_STR_WITH([tmpfilesdir], [override default path to directory with systemd temporary files], [])
 724 test -z "$with_tmpfilesdir" && with_tmpfilesdir=$systemd_tmpfilesdir
 725 test "x$with_tmpfilesdir" = "xno" || {
 726         CS_ABSPATH([${with_tmpfilesdir}],[with-tmpfilesdir])
 727         DEFAULT_TMPFILESDIR=$with_tmpfilesdir
 728         AC_SUBST(DEFAULT_TMPFILESDIR)
 729 }
 730 AM_CONDITIONAL(CRYPTSETUP_TMPFILE, test -n "$DEFAULT_TMPFILESDIR")
 731
 732 CS_STR_WITH([luks2-lock-path], [path to directory for LUKSv2 locks], [/run/cryptsetup])
 733 test -z "$with_luks2_lock_path" && with_luks2_lock_path=/run/cryptsetup
 734 CS_ABSPATH([${with_luks2_lock_path}],[with-luks2-lock-path])
 735 DEFAULT_LUKS2_LOCK_PATH=$with_luks2_lock_path
 736 AC_SUBST(DEFAULT_LUKS2_LOCK_PATH)
 737
 738 CS_NUM_WITH([luks2-lock-dir-perms], [default luks2 locking directory permissions], [0700])
 739 test -z "$with_luks2_lock_dir_perms" && with_luks2_lock_dir_perms=0700
 740 DEFAULT_LUKS2_LOCK_DIR_PERMS=$with_luks2_lock_dir_perms
 741 AC_SUBST(DEFAULT_LUKS2_LOCK_DIR_PERMS)
 742
 743 CS_STR_WITH([luks2-external-tokens-path], [path to directory with LUKSv2 external token handlers (plugins)], [LIBDIR/cryptsetup])
 744 if test -n "$with_luks2_external_tokens_path"; then
 745         CS_ABSPATH([${with_luks2_external_tokens_path}],[with-luks2-external-tokens-path])
 746         EXTERNAL_LUKS2_TOKENS_PATH=$with_luks2_external_tokens_path
 747 else
 748         EXTERNAL_LUKS2_TOKENS_PATH="\${libdir}/cryptsetup"
 749 fi
 750 AC_SUBST(EXTERNAL_LUKS2_TOKENS_PATH)
 751
 752 dnl Override default LUKS format version (for cryptsetup or cryptsetup-reencrypt format actions only).
 753 AC_ARG_WITH([default_luks_format],
 754         AS_HELP_STRING([--with-default-luks-format=FORMAT], [default LUKS format version (LUKS1/LUKS2) [LUKS2]]),
 755         [], [with_default_luks_format=LUKS2])
 756
 757 case $with_default_luks_format in
 758         LUKS1) default_luks=CRYPT_LUKS1 ;;
 759         LUKS2) default_luks=CRYPT_LUKS2 ;;
 760         *) AC_MSG_ERROR([Unknown default LUKS format. Use LUKS1 or LUKS2 only.]) ;;
 761 esac
 762 AC_DEFINE_UNQUOTED([DEFAULT_LUKS_FORMAT], [$default_luks], [default LUKS format version])
 763
 764 dnl ==========================================================================
 765
 766 AC_CONFIG_FILES([ Makefile
 767 lib/libcryptsetup.pc
 768 po/Makefile.in
 769 scripts/cryptsetup.conf
 770 tests/Makefile
 771 tests/fuzz/Makefile
 772 ])
 773 AC_OUTPUT