From Maciej W. Rozycki <[email protected]>:

	Here is a patch that addresses a few SSL-related issues noticed:

	1. The "/usr" directory is not the best choice to start looking
	   for SSL libraries when cross-compiling.  The patch adds
	   "/usr/${host_alias}" at the front.  Actually the test is quite
	   bogus anyway -- there might be no libcrypto.a library at all
	   (but e.g. libcrypto.so), so a better approach would be trying to
	   link against -lcrypto and seeing if that works.  First with no
	   additional options (it might be in the default compiler/linker's
	   search patch, like on sane systems), then with the -L<dir>
	option.

	2. The "cast.h" and "rc5.h" headers should include the
	   "openssl/" path as that is what is used throughout the code.
	   Right now they are simply not found by configure.

	3. The buggy CAST128 test should use a cache variable to permit
	   overriding by an educated user.

	I think I may actually rewrite the test as described in #1 above
	one day, but my time is quite limited and tcpdump is not my
	priority task, so it might not happen soon.  I won't mind if
	someone does it earlier.

diff --git a/config.h.in b/config.h.in
index 6b53a06b50c713f53624f72c9b66fee579214f1b..351cca3edf5d2e23f1f63025d8f3dbee7e442228 100644 (file)
--- a/config.h.in
+++ b/config.h.in
@@ -165,9 +165,6 @@
 /* Define if you have the vsnprintf function.  */
 #undef HAVE_VSNPRINTF
 
-/* Define if you have the <cast.h> header file.  */
-#undef HAVE_CAST_H
-
 /* Define if you have the <fcntl.h> header file.  */
 #undef HAVE_FCNTL_H
 
@@ -177,8 +174,11 @@
 /* Define if you have the <netinet/if_ether.h> header file.  */
 #undef HAVE_NETINET_IF_ETHER_H
 
-/* Define if you have the <rc5.h> header file.  */
-#undef HAVE_RC5_H
+/* Define if you have the <openssl/cast.h> header file.  */
+#undef HAVE_OPENSSL_CAST_H
+
+/* Define if you have the <openssl/rc5.h> header file.  */
+#undef HAVE_OPENSSL_RC5_H
 
 /* Define if you have the <rpc/rpcent.h> header file.  */
 #undef HAVE_RPC_RPCENT_H

diff --git a/configure b/configure
index dc3bcb1c5b756227c432794e6e502be09538164f..bd689fb80e93b42d42675dbd7198fd0c1248ffaa 100755 (executable)
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 
-# From configure.in Revision: 1.148 
+# From configure.in Revision: 1.149 
 
 
 
@@ -4362,7 +4362,7 @@ echo $ac_n "checking for SSLeay""... $ac_c" 1>&6
 echo "configure:4363: checking for SSLeay" >&5
 ac_cv_ssleay_path=no
 incdir=no
-for dir in /usr /usr/local /usr/local/ssl /usr/pkg; do
+for dir in /usr/${host_alias} /usr /usr/local /usr/local/ssl /usr/pkg; do
        if test -d $dir/lib -a -f $dir/lib/libcrypto.a; then
                ac_cv_ssleay_path=$dir
        fi
@@ -4436,7 +4436,7 @@ fi
 
        bak_CPPFLAGS=$CPPFLAGS
        CPPFLAGS="$CPPFLAGS $V_INCLS"
-       for ac_hdr in cast.h
+       for ac_hdr in openssl/cast.h
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
@@ -4477,17 +4477,20 @@ fi
 done
 
 
-       if test "$ac_cv_header_cast_h" = "yes"; then
+       if test "$ac_cv_header_openssl_cast_h" = "yes"; then
                echo $ac_n "checking for buggy CAST128""... $ac_c" 1>&6
 echo "configure:4483: checking for buggy CAST128" >&5
-               if test "$cross_compiling" = yes; then
-  buggy_cast128="cross-compiling, assume yes"
+               if eval "test \"`echo '$''{'td_cv_buggy_cast128'+set}'`\" = set"; then
+  echo $ac_n "(cached) $ac_c" 1>&6
+else
+  if test "$cross_compiling" = yes; then
+  td_cv_buggy_cast128="cross-compiling, assume yes"
 else
   cat > conftest.$ac_ext <<EOF
-#line 4488 "configure"
+#line 4491 "configure"
 #include "confdefs.h"
 
-#include <cast.h>
+#include <openssl/cast.h>
 main()
 {
        unsigned char key[] = {0x01,0x23,0x45,0x67,0x12};
@@ -4503,20 +4506,22 @@ main()
                return 1;
 }
 EOF
-if { (eval echo configure:4507: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
+if { (eval echo configure:4510: \"$ac_link\") 1>&5; (eval $ac_link) 2>&5; } && test -s conftest${ac_exeext} && (./conftest; exit) 2>/dev/null
 then
-  buggy_cast128=yes
+  td_cv_buggy_cast128=yes
 else
   echo "configure: failed program was:" >&5
   cat conftest.$ac_ext >&5
   rm -fr conftest*
-  buggy_cast128=no
+  td_cv_buggy_cast128=no
 fi
 rm -fr conftest*
 fi
 
-               echo "$ac_t""$buggy_cast128" 1>&6
-               if test "$buggy_cast128" != no; then
+fi
+
+               echo "$ac_t""$td_cv_buggy_cast128" 1>&6
+               if test "$td_cv_buggy_cast128" != no; then
                        echo "NOTE: SSLeay 0.9.0b has a bug in CAST128 en/decoding routine."
                        echo "disabling CAST128 support."
                        cat >> confdefs.h <<\EOF
@@ -4531,21 +4536,21 @@ fi
 
 fi
 
-for ac_hdr in rc5.h
+for ac_hdr in openssl/rc5.h
 do
 ac_safe=`echo "$ac_hdr" | sed 'y%./+-%__p_%'`
 echo $ac_n "checking for $ac_hdr""... $ac_c" 1>&6
-echo "configure:4539: checking for $ac_hdr" >&5
+echo "configure:4544: checking for $ac_hdr" >&5
 if eval "test \"`echo '$''{'ac_cv_header_$ac_safe'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6
 else
   cat > conftest.$ac_ext <<EOF
-#line 4544 "configure"
+#line 4549 "configure"
 #include "confdefs.h"
 #include <$ac_hdr>
 EOF
 ac_try="$ac_cpp conftest.$ac_ext >/dev/null 2>conftest.out"
-{ (eval echo configure:4549: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
+{ (eval echo configure:4554: \"$ac_try\") 1>&5; (eval $ac_try) 2>&5; }
 ac_err=`grep -v '^ *+' conftest.out | grep -v "^conftest.${ac_ext}\$"`
 if test -z "$ac_err"; then
   rm -rf conftest*
@@ -4590,7 +4595,7 @@ done
 # SVR4 /usr/ucb/install, which tries to use the nonexistent group "staff"
 # ./install, which can be erroneously created by make from ./install.sh.
 echo $ac_n "checking for a BSD compatible install""... $ac_c" 1>&6
-echo "configure:4594: checking for a BSD compatible install" >&5
+echo "configure:4599: checking for a BSD compatible install" >&5
 if test -z "$INSTALL"; then
 if eval "test \"`echo '$''{'ac_cv_path_install'+set}'`\" = set"; then
   echo $ac_n "(cached) $ac_c" 1>&6

diff --git a/configure.in b/configure.in
index 69ff8d6402b937864494d33062e47c5068285fd2..1c87af4a435f0e94da960666aedca149e0567fad 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -1,4 +1,4 @@
-dnl @(#) $Header: /tcpdump/master/tcpdump/configure.in,v 1.148 2002-04-07 02:12:01 guy Exp $ (LBL)
+dnl @(#) $Header: /tcpdump/master/tcpdump/configure.in,v 1.149 2002-04-07 02:16:03 guy Exp $ (LBL)
 dnl
 dnl Copyright (c) 1994, 1995, 1996, 1997
 dnl    The Regents of the University of California.  All rights reserved.
@@ -6,7 +6,7 @@ dnl
 dnl Process this file with autoconf to produce a configure script.
 dnl
 
-AC_REVISION($Revision: 1.148 $)
+AC_REVISION($Revision: 1.149 $)
 AC_PREREQ(2.13)
 AC_INIT(tcpdump.c)
 
@@ -585,7 +585,7 @@ AC_ARG_WITH(crypto, [  --without-crypto        disable crypto support],
 AC_MSG_CHECKING(for SSLeay)
 ac_cv_ssleay_path=no
 incdir=no
-for dir in /usr /usr/local /usr/local/ssl /usr/pkg; do
+for dir in /usr/${host_alias} /usr /usr/local /usr/local/ssl /usr/pkg; do
        if test -d $dir/lib -a -f $dir/lib/libcrypto.a; then
                ac_cv_ssleay_path=$dir
        fi
@@ -613,13 +613,13 @@ if test "$ac_cv_ssleay_path" != no; then
 
        bak_CPPFLAGS=$CPPFLAGS
        CPPFLAGS="$CPPFLAGS $V_INCLS"
-       AC_CHECK_HEADERS(cast.h)
+       AC_CHECK_HEADERS(openssl/cast.h)
 
-       if test "$ac_cv_header_cast_h" = "yes"; then
+       if test "$ac_cv_header_openssl_cast_h" = "yes"; then
                AC_MSG_CHECKING(for buggy CAST128)
-               AC_TRY_RUN(dnl
+               AC_CACHE_VAL(td_cv_buggy_cast128, [AC_TRY_RUN(dnl
 [
-#include <cast.h>
+#include <openssl/cast.h>
 main()
 {
        unsigned char key[] = {0x01,0x23,0x45,0x67,0x12};
@@ -634,11 +634,11 @@ main()
        else
                return 1;
 }],
-                       [buggy_cast128=yes],
-                       [buggy_cast128=no],
-                       [buggy_cast128="cross-compiling, assume yes"])
-               AC_MSG_RESULT($buggy_cast128)
-               if test "$buggy_cast128" != no; then
+                       [td_cv_buggy_cast128=yes],
+                       [td_cv_buggy_cast128=no],
+                       [td_cv_buggy_cast128="cross-compiling, assume yes"])])
+               AC_MSG_RESULT($td_cv_buggy_cast128)
+               if test "$td_cv_buggy_cast128" != no; then
                        echo "NOTE: SSLeay 0.9.0b has a bug in CAST128 en/decoding routine."
                        echo "disabling CAST128 support."
                        AC_DEFINE(HAVE_BUGGY_CAST128)
@@ -648,7 +648,7 @@ main()
        CPPFLAGS=$bak_CPPFLAGS
 fi
 ])
-AC_CHECK_HEADERS(rc5.h)
+AC_CHECK_HEADERS(openssl/rc5.h)
 
 AC_SUBST(V_CCOPT)
 AC_SUBST(V_GROUP)

diff --git a/print-esp.c b/print-esp.c
index aef0dc325f4caefb4bb6b53b1f3afbdbebad3225..957245084473fc7abab1a748b125a9060701ec71 100644 (file)
--- a/print-esp.c
+++ b/print-esp.c
@@ -23,7 +23,7 @@
 
 #ifndef lint
 static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-esp.c,v 1.23 2002-02-18 08:54:56 itojun Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-esp.c,v 1.24 2002-04-07 02:16:03 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -42,10 +42,10 @@ static const char rcsid[] =
 #ifdef HAVE_LIBCRYPTO
 #include <openssl/des.h>
 #include <openssl/blowfish.h>
-#ifdef HAVE_RC5_H
+#ifdef HAVE_OPENSSL_RC5_H
 #include <openssl/rc5.h>
 #endif
-#ifdef HAVE_CAST_H
+#ifdef HAVE_OPENSSL_CAST_H
 #include <openssl/cast.h>
 #endif
 #endif