Index: /branches/rel_apv_10_7_1/usr/click/bin/openssh/array_patch =================================================================== --- /branches/rel_apv_10_7_1/usr/click/bin/openssh/array_patch (revision 38213) +++ /branches/rel_apv_10_7_1/usr/click/bin/openssh/array_patch (working copy) @@ -796,7 +796,7 @@ sshd$(EXEEXT): libssh.a $(LIBCOMPAT) $(SSHDOBJS) - $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS) -+ $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS) -L ../../objdir/ -L../../../lib/libexauth -lexauth -L../../../lib/libuinet-atcp/lib/libuinet -luinet_lite -L../../../lib/libuinet-atcp/lib/libuinet_sysctl -luinet_sysctl -L../../../lib/libuinet-atcp/lib/libuinetnv -luinetnv -lrt -lcrypto -L../../../lib/libfastlog -lfastlog ++ $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lldap -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS) -L ../../objdir/ -L../../../lib/libexauth -lexauth -L../../../lib/libuinet-atcp/lib/libuinet -luinet_lite -L../../../lib/libuinet-atcp/lib/libuinet_sysctl -luinet_sysctl -L../../../lib/libuinet-atcp/lib/libuinetnv -luinetnv -lrt -lcrypto -L../../../lib/libfastlog -lfastlog + +synconfigd$(EXEEXT): sshd$(EXEEXT) + /bin/cp sshd$(EXEEXT) $@ Index: /branches/rel_apv_10_7_1/usr/click/lib/libexauth/Makefile =================================================================== --- /branches/rel_apv_10_7_1/usr/click/lib/libexauth/Makefile (revision 38213) +++ /branches/rel_apv_10_7_1/usr/click/lib/libexauth/Makefile (working copy) @@ -5,10 +5,14 @@ INCS= auth_ext.h auth_ext_cli.h auth_ext_ipc.h radlib.h taclib.h CFLAGS+=-I${.CURDIR} \ - -I${.CURDIR}/../../lib/libfastlog + -I${.CURDIR}/../../lib/libfastlog \ + -I${.CURDIR}/../../lib/libbsd .if defined(USTACK) CFLAGS += -fPIC .endif -.include +LDADD=-L${.OBJDIR}/../../lib/libbsd -lbsd \ + -lmd -lcrypt -lcrypto -lpthread -lldap -llber -lhiredis -lutil + +.include Index: /branches/rel_apv_10_7_1/usr/click/lib/libexauth/auth_ext.h =================================================================== --- /branches/rel_apv_10_7_1/usr/click/lib/libexauth/auth_ext.h (revision 38213) +++ /branches/rel_apv_10_7_1/usr/click/lib/libexauth/auth_ext.h (working copy) @@ -26,7 +26,7 @@ #define RAD_AUTH_PORT 1812 #define RAD_DEF_TIMEOUT 5 #define RAD_DEF_RETRIES 2 - +#define LDAP_DEF_RETRIES 2 #define EXT_AUTH_OFF 0 #define EXT_AUTH_ON 1 @@ -101,6 +101,9 @@ /*authenticate with external tacacs+ server*/ int external_auth_tacx(char *username, char *password); +/*authenticate with external ldap server*/ +int external_auth_ldap(char *username, char *password); + /*check the return type of tacacs+ server*/ int check_tac_x_type(int ret_type, char *buf); Index: /branches/rel_apv_10_7_1/usr/click/lib/libexauth/auth_ext.c =================================================================== --- /branches/rel_apv_10_7_1/usr/click/lib/libexauth/auth_ext.c (revision 38213) +++ /branches/rel_apv_10_7_1/usr/click/lib/libexauth/auth_ext.c (working copy) @@ -32,7 +32,7 @@ #include #include #include - +#include #include "auth_ext.h" #include "auth_ext_cli.h" #include "auth_ext_ipc.h" @@ -81,6 +81,10 @@ sprintf(buf, "%s", EXAUTH_METHOD_STRING_TAC_X); } + if (g_exauth_conf.exau_method == METHOD_LDAP) { + sprintf(buf, "%s", EXAUTH_METHOD_STRING_LDAP); + } + return 0; } @@ -171,6 +175,10 @@ return external_auth_tacx(username, password); break; + case METHOD_LDAP: + return external_auth_ldap(username, password); + break; + default: exau_log("external_auth: no authenticaion method found"); return EXT_AUTH_FAILED; @@ -181,6 +189,124 @@ } +int +external_auth_ldap(char *username, char *password) +{ + /*the return value of ldap response type*/ + int ret_value = EXT_AUTH_FAILED; + int i; + if (username == NULL || password == NULL) { + return EXT_AUTH_FAILED; + } + /*authenticate ldap servers*/ + for (i = 0; i < MAX_EXAU_SERVER_NUM; i++) { + if (g_exauth_conf.exauth_servers[i].id && + g_exauth_conf.exauth_servers[i].id[0] != '\0') { + ret_value = external_auth_one_ldap(i, username, password); + if ((ret_value == EXT_AUTH_PASS_CONFIG) || + (ret_value == EXT_AUTH_PASS_ENABLE)) { + break; + } + } + } + return ret_value; +} +int +external_auth_one_ldap(int server_num, char *username, char *password) +{ + LDAP *ldap; + struct timeval to; + int ldap_version = LDAP_VERSION3; + int msgid = 0; + to.tv_sec = 600; + to.tv_usec = 0; + int ret_value = EXT_AUTH_FAILED; + int i = server_num; + LDAPMessage *answer, *entry; + char *attrs[] = {"memberOf", NULL}; + int attrsonly = 0; + int entries_found = 0; + + if (username == NULL || password == NULL) { + return EXT_AUTH_FAILED; + } + char ldap_uri[1024]; + sprintf(ldap_uri,"ldap://%s:%d",g_exauth_conf.exauth_servers[i].host, + g_exauth_conf.exauth_servers[i].port); + if ( ldap_initialize(&ldap, ldap_uri) != LDAP_SUCCESS ) { + exau_log( "ldap_init failed" ); + return EXT_AUTH_FAILED; + } else { + exau_log("Generated LDAP handle for uri %s.\n", ldap_uri); + } + + if (ldap_set_option(ldap, LDAP_OPT_TIMEOUT,&to) != LDAP_SUCCESS ) { + return EXT_AUTH_FAILED; + } + + if (ldap_set_option(ldap, LDAP_OPT_NETWORK_TIMEOUT,&to) != LDAP_SUCCESS ) { + return EXT_AUTH_FAILED; + } + + if (ldap_set_option(ldap, LDAP_OPT_PROTOCOL_VERSION, &ldap_version) != LDAP_SUCCESS ) { + return EXT_AUTH_FAILED; + } + // This is AD bug, if password is blank it allows tp login + if (strlen(password) == 0) { + return EXT_AUTH_FAILED; + } + msgid = ldap_simple_bind_s(ldap, username, password); + + if ( msgid != LDAP_SUCCESS ) { + exau_log("LDAP login failed for user %s.\n", username); + return EXT_AUTH_FAILED; + } else { + exau_log("LDAP login successful for user %s.\n", username); + ret_value = EXT_AUTH_PASS_CONFIG; + } + // authorization off then will not do authorization only authentication + if (g_exauth_conf.external_authorize_on == EXT_AUTHORIZE_OFF){ + exau_log("LDAP authorization off for user %s.\n", username); + ret_value = EXT_AUTH_PASS_CONFIG; + ldap_unbind(ldap); + return ret_value; + } + //authorization block + char search_string[1024]; + if (strstr(username, "@")) { + sprintf(search_string,"\(\&\(userPrincipalName\=%s\)\(memberOf=%s\)\)", username, g_exauth_conf.exauth_servers[i].memberOf); + } else { + sprintf(search_string,"\(\&\(sAMAccountName\=%s\)\(memberOf=%s\)\)", username, g_exauth_conf.exauth_servers[i].memberOf); + } + + msgid = ldap_search_s(ldap, g_exauth_conf.exauth_servers[i].dn, LDAP_SCOPE_SUBTREE, search_string, + attrs, attrsonly, &answer); + + if ( msgid != LDAP_SUCCESS ) { + exau_log("LDAP search failed for user %s.\n", username); + return EXT_AUTH_FAILED; + } else { + exau_log("LDAP search successful for user %s.\n", username); + } + + /* Return the number of objects found during the search */ + entries_found = ldap_count_entries(ldap, answer); + if ( entries_found == 0 ) { + exau_log("LDAP authorization failed for user %s.\n", username); + ret_value = EXT_AUTH_PASS_ENABLE; // if authorization failed then not allow to do any change + } else { + ret_value = EXT_AUTH_PASS_CONFIG; + printf("LDAP authorization success for user %s.\n", username); + } + if (ret_value != EXT_AUTH_PASS_CONFIG) { + ret_value = EXT_AUTH_PASS_ENABLE; + } + + ldap_msgfree(answer); + ldap_unbind(ldap); + return ret_value; +} + /*authenticate with external radius server*/ /*To support ipv6 auth server, we modified the libradius library to support ipv6 too. This library can handle up to 10 auth servers in one auth request, when we originate Index: /branches/rel_apv_10_7_1/usr/click/lib/libexauth/auth_ext_cli.h =================================================================== --- /branches/rel_apv_10_7_1/usr/click/lib/libexauth/auth_ext_cli.h (revision 38213) +++ /branches/rel_apv_10_7_1/usr/click/lib/libexauth/auth_ext_cli.h (working copy) @@ -21,9 +21,11 @@ #define LINE_LEN 255 #define HOST_LEN 256 +#define DN_LEN 256 +#define MEMBEROF_LEN 256 #define SECRET_LEN 129 #define EXAUTH_DEF_METHOD "RADIUS" -#define MAX_EXAU_SERVER_NUM 2 +#define MAX_EXAU_SERVER_NUM 3 #define IP_PRESENTATION_LEN 100 /*ip presentation length*/ #define CLI_EXAUTH_ON "admin aaa on" @@ -38,9 +40,10 @@ #define EXAUTH_SERVER_ID1 "es01" #define EXAUTH_SERVER_ID2 "es02" - +#define EXAUTH_SERVER_ID3 "es03" #define EXAUTH_METHOD_STRING_RADIUS "RADIUS" #define EXAUTH_METHOD_STRING_TAC_X "TAC_X" +#define EXAUTH_METHOD_STRING_LDAP "LDAP" #define EXAUTH_METHOD_STRING_UNKONWN "UNKONWN METHOD" #define EXAUTH_PRIORITY_HIGH 1 @@ -49,7 +52,8 @@ /*authentication method table*/ typedef enum exau_method { METHOD_RADIUS, - METHOD_TAC_X + METHOD_TAC_X, + METHOD_LDAP } enum_exau_method; /*the structure for radius server*/ @@ -60,6 +64,8 @@ char secret[SECRET_LEN]; unsigned short timeout; unsigned short max_retry; + char dn[DN_LEN]; + char memberOf[MEMBEROF_LEN]; } exauth_server_t; /*the structure wrapper*/ @@ -68,7 +74,7 @@ int external_authorize_on; int ext_auth_priority; enum_exau_method exau_method; - exauth_server_t exauth_servers[2]; + exauth_server_t exauth_servers[3]; } exauth_conf_t; /*turn on external authentication*/ Index: /branches/rel_apv_10_7_1/usr/click/lib/libexauth/auth_ext_cli.c =================================================================== --- /branches/rel_apv_10_7_1/usr/click/lib/libexauth/auth_ext_cli.c (revision 38213) +++ /branches/rel_apv_10_7_1/usr/click/lib/libexauth/auth_ext_cli.c (working copy) @@ -149,9 +149,13 @@ { g_exauth_conf.exau_method = METHOD_TAC_X; } + else if (strcasecmp(method, EXAUTH_METHOD_STRING_LDAP) == 0) + { + g_exauth_conf.exau_method = METHOD_LDAP; + } else { - printf ("%s | %s\n",EXAUTH_METHOD_STRING_RADIUS, EXAUTH_METHOD_STRING_TAC_X); + printf ("%s | %s | %s \n",EXAUTH_METHOD_STRING_RADIUS, EXAUTH_METHOD_STRING_TAC_X, EXAUTH_METHOD_STRING_LDAP); } /*update conf to shared mem*/ @@ -160,9 +164,58 @@ return 0; } -/*configure an exauth server*/ +/*configure an exauth ldap server*/ +int +exauth_ldap_server(char *id, char *host, uint16_t port, char *dn, char *memberOf) +{ + int id_num = -1; + char *str_num = NULL, *ep = NULL; + + + if (id == NULL || host == NULL || dn == NULL || memberOf == NULL) + { + printf ("%s failed\n",CLI_EXAUTH_SERVER); + return -1; + } + + get_auth_conf(&shm_p, &g_exauth_conf); + + /*invalid server id, should be "es01" or "es02"*/ + if (strcmp(id, EXAUTH_SERVER_ID3)) + { + printf ("%s \n", EXAUTH_SERVER_ID3); + return 0; + } + + /*assign id*/ + str_num = id + 3; + id_num = (int)strtol(str_num, &ep,10) - 1; + + if (id_num == 2) + { + strcpy(g_exauth_conf.exauth_servers[id_num].id, EXAUTH_SERVER_ID3); + } + + /*assign host*/ + strncpy(g_exauth_conf.exauth_servers[id_num].host, host, HOST_LEN); + + /*assign port*/ + g_exauth_conf.exauth_servers[id_num].port = port; + /*assign dn*/ + strncpy(g_exauth_conf.exauth_servers[id_num].dn, dn, DN_LEN); + + /*assign memberOf*/ + strncpy(g_exauth_conf.exauth_servers[id_num].memberOf, memberOf, MEMBEROF_LEN); + + g_exauth_conf.exauth_servers[id_num].max_retry = LDAP_DEF_RETRIES; + /*update conf to shared mem*/ + set_auth_conf(&shm_p, &g_exauth_conf); + return 0; +} + +/*configure an exauth radius server*/ int -exauth_server(char *id, char *host, uint16_t port, char *secret, char *cipher_flag) +exauth_radius_server(char *id, char *host, uint16_t port, char *secret, char *cipher_flag) { int id_num = -1; char *str_num = NULL, *ep = NULL; @@ -252,9 +305,9 @@ return -1; } - if (strcmp(id, EXAUTH_SERVER_ID1) && strcmp(id, EXAUTH_SERVER_ID2)) + if (strcmp(id, EXAUTH_SERVER_ID1) && strcmp(id, EXAUTH_SERVER_ID2) && strcmp(id, EXAUTH_SERVER_ID3)) { - printf ("%s | %s\n",EXAUTH_SERVER_ID1, EXAUTH_SERVER_ID2); + printf ("%s | %s | %s\n",EXAUTH_SERVER_ID1, EXAUTH_SERVER_ID2, EXAUTH_SERVER_ID3); return 0; } @@ -311,6 +364,9 @@ case METHOD_TAC_X: printf("%s %s\n", CLI_EXAUTH_METHOD, EXAUTH_METHOD_STRING_TAC_X); break; + case METHOD_LDAP: + printf("%s %s\n", CLI_EXAUTH_METHOD, EXAUTH_METHOD_STRING_LDAP); + break; default: printf ("show %s faild\n", CLI_EXAUTH_METHOD); @@ -322,13 +378,24 @@ { if (g_exauth_conf.exauth_servers[i].id && g_exauth_conf.exauth_servers[i].id[0] != '\0') { - printf ("%s %s \"%s\" %d \"%s\"\n", - CLI_EXAUTH_SERVER, - g_exauth_conf.exauth_servers[i].id, - g_exauth_conf.exauth_servers[i].host, - g_exauth_conf.exauth_servers[i].port, - "*****" - ); + if (g_exauth_conf.exau_method == METHOD_LDAP) { + printf ("%s ldap %s \"%s\" %d \"%s\" \"%s\" \n", + CLI_EXAUTH_SERVER, + g_exauth_conf.exauth_servers[i].id, + g_exauth_conf.exauth_servers[i].host, + g_exauth_conf.exauth_servers[i].port, + g_exauth_conf.exauth_servers[i].dn, + g_exauth_conf.exauth_servers[i].memberOf + ); + } else { + printf ("%s radiustacacs %s \"%s\" %d \"%s\"\n", + CLI_EXAUTH_SERVER, + g_exauth_conf.exauth_servers[i].id, + g_exauth_conf.exauth_servers[i].host, + g_exauth_conf.exauth_servers[i].port, + "*****" + ); + } } } @@ -412,6 +479,9 @@ case METHOD_TAC_X: buf_offset += sprintf(conf_buf + buf_offset, "%s %s\n", CLI_EXAUTH_METHOD, EXAUTH_METHOD_STRING_TAC_X); break; + case METHOD_LDAP: + buf_offset += sprintf(conf_buf + buf_offset, "%s %s\n", CLI_EXAUTH_METHOD, EXAUTH_METHOD_STRING_LDAP); + break; default: printf ("show %s faild\n", CLI_EXAUTH_METHOD); @@ -423,15 +493,26 @@ { if (g_exauth_conf.exauth_servers[i].id && g_exauth_conf.exauth_servers[i].id[0] != '\0') { - encrypt_secret((unsigned char *)(g_exauth_conf.exauth_servers[i].secret), encrypted_secret); - buf_offset += sprintf (conf_buf + buf_offset, "%s %s \"%s\" %d \"%s\" \"%s\"\n", - CLI_EXAUTH_SERVER, - g_exauth_conf.exauth_servers[i].id, - g_exauth_conf.exauth_servers[i].host, - g_exauth_conf.exauth_servers[i].port, - encrypted_secret, - AAA_SECRET_ENCRYPTED - ); + if (g_exauth_conf.exau_method == METHOD_LDAP) { + buf_offset += sprintf (conf_buf + buf_offset, "%s ldap %s \"%s\" %d \"%s\" \"%s\"\n", + CLI_EXAUTH_SERVER, + g_exauth_conf.exauth_servers[i].id, + g_exauth_conf.exauth_servers[i].host, + g_exauth_conf.exauth_servers[i].port, + g_exauth_conf.exauth_servers[i].dn, + g_exauth_conf.exauth_servers[i].memberOf + ); + } else { + encrypt_secret((unsigned char *)(g_exauth_conf.exauth_servers[i].secret), encrypted_secret); + buf_offset += sprintf (conf_buf + buf_offset, "%s radius %s \"%s\" %d \"%s\" \"%s\"\n", + CLI_EXAUTH_SERVER, + g_exauth_conf.exauth_servers[i].id, + g_exauth_conf.exauth_servers[i].host, + g_exauth_conf.exauth_servers[i].port, + encrypted_secret, + AAA_SECRET_ENCRYPTED + ); + } } } } Index: /branches/rel_apv_10_7_1/usr/click/lib/libparser/commands.pm =================================================================== --- /branches/rel_apv_10_7_1/usr/click/lib/libparser/commands.pm (revision 38213) +++ /branches/rel_apv_10_7_1/usr/click/lib/libparser/commands.pm (working copy) @@ -48705,19 +48705,28 @@ function_name => "exauth_method", function_args => [{ type => "STRING", - help_string => "method name(RADIUS or TAC_X, default is RADIUS)", + help_string => "method name(RADIUS or TAC_X or LDAP, default is RADIUS)", optional => "YES", default_value => "\"RADIUS\"", },], }, + { + obj_type => "MENU", + name => "server", + parent_menu => "root_admin_aaa", + uniq_name => "root_admin_server_aaa", + cmd_attribute => "CMD_ARRAYOS|CMD_NORMAL", + user_level => "CLI_LEVEL_CONFIG", + help_string => "External authentication server configuration", + }, { - obj_type => "ITEM", - name => "server", - menu => "root_admin_aaa", - help_string => "Configure external authentication server", - cmd_attribute => "CMD_ARRAYOS|CMD_NORMAL|CMD_GLOBAL|CMD_SPECIAL_LOG", - user_level => "CLI_LEVEL_CONFIG", - function_name => "exauth_server", + obj_type => "ITEM", + name => "radiustacacs", + menu => "root_admin_server_aaa", + help_string => "Configure external authentication server", + cmd_attribute => "CMD_ARRAYOS|CMD_NORMAL|CMD_GLOBAL|CMD_SPECIAL_LOG", + user_level => "CLI_LEVEL_CONFIG", + function_name => "exauth_radius_server", function_args => [{ type => "STRING", help_string => "id, es01 or es02(if server es01 is down, request will be sent to server es02)", @@ -48747,6 +48756,43 @@ }, ], }, + { + obj_type => "ITEM", + name => "ldap", + menu => "root_admin_server_aaa", + help_string => "Configure external authentication server", + cmd_attribute => "CMD_ARRAYOS|CMD_NORMAL|CMD_GLOBAL|CMD_SPECIAL_LOG", + user_level => "CLI_LEVEL_CONFIG", + function_name => "exauth_ldap_server", + function_args => [{ + type => "STRING", + help_string => "id, es03(request will be sent to server es03)", + optional => "NO", + }, + { + type => "STRING", + help_string => "Host name or ip address", + optional => "NO", + }, + { + type => "U16", + help_string => "Port", + optional => "NO", + }, + { + type => "STRING", + help_string => "dn (Ex. OU=Eng,dc=example,dc=in)", + optional => "YES", + default_value => "\"\"", + }, + { + type => "STRING", + help_string => "memberOf (Ex. CN=Engineering,DC=example,DC=in)", + optional => "YES", + default_value => "\"\"", + }, + ], + }, { obj_type => "MENU", name => "authorize", Index: /branches/rel_apv_10_7_1/usr/click/lib/libpyexauth/pyexauth_build.py =================================================================== --- /branches/rel_apv_10_7_1/usr/click/lib/libpyexauth/pyexauth_build.py (revision 38213) +++ /branches/rel_apv_10_7_1/usr/click/lib/libpyexauth/pyexauth_build.py (working copy) @@ -33,7 +33,7 @@ """, include_dirs=["../libexauth", "../libpyauth"], library_dirs=tmp_library_dirs, - libraries=["exauth", "fastlog", "bsd", "ssl", "pyauth", "crypt", "uinet_sysctl", "uinet_lite", "uinetnv", "rt"]) + libraries=["ldap", "exauth", "fastlog", "bsd", "ssl", "pyauth", "crypt", "uinet_sysctl", "uinet_lite", "uinetnv", "rt"]) if __name__ == "__main__": ffi.compile() Index: /branches/rel_apv_10_7_1/usr/src/share/mk/bsd.libauth.mk =================================================================== --- /branches/rel_apv_10_7_1/usr/src/share/mk/bsd.libauth.mk (revision 0) +++ /branches/rel_apv_10_7_1/usr/src/share/mk/bsd.libauth.mk (working copy) @@ -0,0 +1,496 @@ +# from: @(#)bsd.lib.mk 5.26 (Berkeley) 5/2/91 +# $FreeBSD$ +# + +.include +INSTALLFLAGS+=-D +.if defined(USTACK) +BSD_SYS_INC:= \ + -I${.CURDIR}/../../../sys/include \ + -I${.CURDIR}/../../../src/sys +.for inc in ${BSD_SYS_INC} +CFLAGS:= ${CFLAGS:S/${inc}//g} +.endfor + +.if !defined(NO_USR_INC) +CFLAGS+=-I${.CURDIR}/../../include +.endif + +CFLAGS+=-g \ + -I${RTE_SDK}/${RTE_TARGET}/include \ + -I${.CURDIR}/../../include \ + -I${.CURDIR}/../../lib/libuinet-atcp/lib/libuinet_sysctl \ + -I${.CURDIR}/../../lib/libuinet-atcp/lib/libuinet/api_include \ + -I${.CURDIR}/../../lib/libuinet-atcp/lib/libuinet/machine_include \ + -I${.CURDIR}/../../lib/libuinet-atcp/lib/libuinet_sysctl +#remove the not-yet support libs +LDLIB_NOT_YET_SUPPORT_BY_USTACK= \ + /usr/local/lib/libprotobuf.a \ + /usr/local/lib/libldap.a \ + /usr/local/lib/liblber.a \ + /usr/local/lib/libiconv.a \ + /usr/local/lib/librrd.a \ + -lgeom \ + -lkvm \ + -lmd \ + -lmemstat \ + -lradius \ + -ltacplus +.for lib in ${LDLIB_NOT_YET_SUPPORT_BY_USTACK} +LDADD:= ${LDADD:S/${lib}//g} +.endfor +.endif + +# Set up the variables controlling shared libraries. After this section, +# SHLIB_NAME will be defined only if we are to create a shared library. +# SHLIB_LINK will be defined only if we are to create a link to it. +# INSTALL_PIC_ARCHIVE will be defined only if we are to create a PIC archive. +.if defined(NO_PIC) +.undef SHLIB_NAME +.undef INSTALL_PIC_ARCHIVE +.else +.if !defined(SHLIB) && defined(LIB) +SHLIB= ${LIB} +.endif +.if !defined(SHLIB_NAME) && defined(SHLIB) && defined(SHLIB_MAJOR) +SHLIB_NAME= lib${SHLIB}.so.${SHLIB_MAJOR} +.endif +.if defined(SHLIB_NAME) && !empty(SHLIB_NAME:M*.so.*) +SHLIB_LINK?= ${SHLIB_NAME:R} +.endif +SONAME?= ${SHLIB_NAME} +.endif + +.if defined(CRUNCH_CFLAGS) +CFLAGS+= ${CRUNCH_CFLAGS} +.endif + +.if ${MK_ASSERT_DEBUG} == "no" +CFLAGS+= -DNDEBUG +NO_WERROR= +.endif + +.if defined(DEBUG_FLAGS) +CFLAGS+= ${DEBUG_FLAGS} + +.if ${MK_CTF} != "no" && ${DEBUG_FLAGS:M-g} != "" +CTFFLAGS+= -g +.endif +.else +STRIP?= -s +.endif + +.if ${MK_DEBUG_FILES} != "no" && empty(DEBUG_FLAGS:M-g) && \ + empty(DEBUG_FLAGS:M-gdwarf*) +CFLAGS+= -g +CTFFLAGS+= -g +.endif + +.include + +# prefer .s to a .c, add .po, remove stuff not used in the BSD libraries +# .So used for PIC object files +.SUFFIXES: +.SUFFIXES: .out .o .po .So .S .asm .s .c .cc .cpp .cxx .C .f .y .l .ln + +.if !defined(PICFLAG) +.if ${MACHINE_CPUARCH} == "sparc64" +PICFLAG=-fPIC +.else +PICFLAG=-fpic +.endif +.endif + +PO_FLAG=-pg + +.c.o: + ${CC} ${STATIC_CFLAGS} ${CFLAGS} -c ${.IMPSRC} -o ${.TARGET} ${LDADD} + ${CTFCONVERT_CMD} + +.c.po: + ${CC} ${PO_FLAG} ${STATIC_CFLAGS} ${PO_CFLAGS} -c ${.IMPSRC} -o ${.TARGET} + ${CTFCONVERT_CMD} + +.c.So: + ${CC} ${PICFLAG} -DPIC ${SHARED_CFLAGS} ${CFLAGS} -c ${.IMPSRC} -o ${.TARGET} ${LDADD} + ${CTFCONVERT_CMD} + +.cc.o .C.o .cpp.o .cxx.o: + ${CXX} ${STATIC_CXXFLAGS} ${CXXFLAGS} -c ${.IMPSRC} -o ${.TARGET} + +.cc.po .C.po .cpp.po .cxx.po: + ${CXX} ${PO_FLAG} ${STATIC_CXXFLAGS} ${PO_CXXFLAGS} -c ${.IMPSRC} -o ${.TARGET} + +.cc.So .C.So .cpp.So .cxx.So: + ${CXX} ${PICFLAG} -DPIC ${SHARED_CXXFLAGS} ${CXXFLAGS} -c ${.IMPSRC} -o ${.TARGET} + +.f.po: + ${FC} -pg ${FFLAGS} -o ${.TARGET} -c ${.IMPSRC} + ${CTFCONVERT_CMD} + +.f.So: + ${FC} ${PICFLAG} -DPIC ${FFLAGS} -o ${.TARGET} -c ${.IMPSRC} + ${CTFCONVERT_CMD} + +.s.po .s.So: + ${AS} ${AFLAGS} -o ${.TARGET} ${.IMPSRC} + ${CTFCONVERT_CMD} + +.asm.po: + ${CC} -x assembler-with-cpp -DPROF ${PO_CFLAGS} ${ACFLAGS} \ + -c ${.IMPSRC} -o ${.TARGET} + ${CTFCONVERT_CMD} + +.asm.So: + ${CC} -x assembler-with-cpp ${PICFLAG} -DPIC ${CFLAGS} ${ACFLAGS} ${LDADD} \ + -c ${.IMPSRC} -o ${.TARGET} + ${CTFCONVERT_CMD} + +.S.po: + ${CC} -DPROF ${PO_CFLAGS} ${ACFLAGS} -c ${.IMPSRC} -o ${.TARGET} + ${CTFCONVERT_CMD} + +.S.So: + ${CC} ${PICFLAG} -DPIC ${CFLAGS} ${ACFLAGS} -c ${.IMPSRC} -o ${.TARGET} ${LDADD} + ${CTFCONVERT_CMD} + +all: beforebuild .WAIT +beforebuild: objwarn + +.if defined(PRIVATELIB) +_LIBDIR:=${LIBPRIVATEDIR} +_SHLIBDIR:=${LIBPRIVATEDIR} +.else +_LIBDIR:=${LIBDIR} +_SHLIBDIR:=${SHLIBDIR} +.endif + +.if defined(SHLIB_NAME) +.if ${MK_DEBUG_FILES} != "no" +SHLIB_NAME_FULL=${SHLIB_NAME}.full +# Use ${DEBUGDIR} for base system debug files, else .debug subdirectory +.if ${_SHLIBDIR} == "/boot" ||\ + ${SHLIBDIR:C%/lib(/.*)?$%/lib%} == "/lib" ||\ + ${SHLIBDIR:C%/usr/lib(32)?(/.*)?%/usr/lib%} == "/usr/lib" +DEBUGFILEDIR=${DEBUGDIR}${_SHLIBDIR} +.else +DEBUGFILEDIR=${_SHLIBDIR}/.debug +DEBUGMKDIR= +.endif +.else +SHLIB_NAME_FULL=${SHLIB_NAME} +.endif +.endif + +.include + +# Allow libraries to specify their own version map or have it +# automatically generated (see bsd.symver.mk above). +.if ${MK_SYMVER} == "yes" && !empty(VERSION_MAP) +${SHLIB_NAME_FULL}: ${VERSION_MAP} +LDFLAGS+= -Wl,--version-script=${VERSION_MAP} +.endif + +.if defined(USEPRIVATELIB) +LDFLAGS+= -L${_SHLIBDIRPREFIX}${LIBPRIVATEDIR} -rpath ${LIBPRIVATEDIR} +.endif + +.if defined(LIB) && !empty(LIB) || defined(SHLIB_NAME) +OBJS+= ${SRCS:N*.h:R:S/$/.o/} +.endif + +.if defined(LIB) && !empty(LIB) +_LIBS= lib${LIB}.a + +lib${LIB}.a: ${OBJS} ${STATICOBJS} + @${ECHO} building static ${LIB} library + @rm -f ${.TARGET} +.if !defined(NM) + @${AR} ${ARFLAGS} ${.TARGET} `lorder ${OBJS} ${STATICOBJS} | tsort` ${ARADD} +.else + @${AR} ${ARFLAGS} ${.TARGET} `NM='${NM}' lorder ${OBJS} ${STATICOBJS} | tsort` ${ARADD} +.endif + ${RANLIB} ${RANLIBFLAGS} ${.TARGET} +.endif + +.if !defined(INTERNALLIB) + +.if ${MK_PROFILE} != "no" && defined(LIB) && !empty(LIB) +_LIBS+= lib${LIB}_p.a +POBJS+= ${OBJS:.o=.po} ${STATICOBJS:.o=.po} + +lib${LIB}_p.a: ${POBJS} + @${ECHO} building profiled ${LIB} library + @rm -f ${.TARGET} +.if !defined(NM) + @${AR} ${ARFLAGS} ${.TARGET} `lorder ${POBJS} | tsort` ${ARADD} +.else + @${AR} ${ARFLAGS} ${.TARGET} `NM='${NM}' lorder ${POBJS} | tsort` ${ARADD} +.endif + ${RANLIB} ${RANLIBFLAGS} ${.TARGET} +.endif + +.if defined(SHLIB_NAME) || \ + defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB) +SOBJS+= ${OBJS:.o=.So} +.endif + +.if defined(SHLIB_NAME) +_LIBS+= ${SHLIB_NAME} + +SOLINKOPTS= -shared -Wl,-x +.if !defined(ALLOW_SHARED_TEXTREL) +SOLINKOPTS+= -Wl,--fatal-warnings -Wl,--warn-shared-textrel +.endif + +.if target(beforelinking) +beforelinking: ${SOBJS} +${SHLIB_NAME_FULL}: beforelinking +.endif +${SHLIB_NAME_FULL}: ${SOBJS} + @${ECHO} building shared library ${SHLIB_NAME} + @rm -f ${SHLIB_NAME} ${SHLIB_LINK} +.if defined(SHLIB_LINK) + @${INSTALL_SYMLINK} ${SHLIB_NAME} ${SHLIB_LINK} +.endif +.if !defined(NM) + @${CC} ${LDFLAGS} ${SSP_CFLAGS} ${SOLINKOPTS} \ + -o ${.TARGET} -Wl,-soname,${SONAME} \ + `lorder ${SOBJS} | tsort` ${LDADD} +.else + @${CC} ${LDFLAGS} ${SSP_CFLAGS} ${SOLINKOPTS} \ + -o ${.TARGET} -Wl,-soname,${SONAME} \ + `NM='${NM}' lorder ${SOBJS} | tsort` ${LDADD} +.endif +.if ${MK_CTF} != "no" + ${CTFMERGE} ${CTFFLAGS} -o ${.TARGET} ${SOBJS} +.endif + +.if ${MK_DEBUG_FILES} != "no" +CLEANFILES+= ${SHLIB_NAME_FULL} ${SHLIB_NAME}.debug +${SHLIB_NAME}: ${SHLIB_NAME_FULL} ${SHLIB_NAME}.debug + ${OBJCOPY} --strip-debug --add-gnu-debuglink=${SHLIB_NAME}.debug \ + ${SHLIB_NAME_FULL} ${.TARGET} + +${SHLIB_NAME}.debug: ${SHLIB_NAME_FULL} + ${OBJCOPY} --only-keep-debug ${SHLIB_NAME_FULL} ${.TARGET} +.endif +.endif #defined(SHLIB_NAME) + +.if defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB) && ${MK_TOOLCHAIN} != "no" +_LIBS+= lib${LIB}_pic.a + +lib${LIB}_pic.a: ${SOBJS} + @${ECHO} building special pic ${LIB} library + @rm -f ${.TARGET} + @${AR} ${ARFLAGS} ${.TARGET} ${SOBJS} ${ARADD} + ${RANLIB} ${RANLIBFLAGS} ${.TARGET} +.endif + +.if defined(WANT_LINT) && !defined(NO_LINT) && defined(LIB) && !empty(LIB) +LINTLIB= llib-l${LIB}.ln +_LIBS+= ${LINTLIB} +LINTOBJS+= ${SRCS:M*.c:.c=.ln} + +${LINTLIB}: ${LINTOBJS} + @${ECHO} building lint library ${.TARGET} + @rm -f ${.TARGET} + ${LINT} ${LINTLIBFLAGS} ${CFLAGS:M-[DIU]*} ${.ALLSRC} +.endif + +.endif # !defined(INTERNALLIB) + +all: ${_LIBS} + +.if ${MK_MAN} != "no" +all: _manpages +.endif + +_EXTRADEPEND: + @TMP=_depend$$$$; \ + sed -e 's/^\([^\.]*\).o[ ]*:/\1.o \1.po \1.So:/' < ${DEPENDFILE} \ + > $$TMP; \ + mv $$TMP ${DEPENDFILE} +.if !defined(NO_EXTRADEPEND) && defined(SHLIB_NAME) +.if defined(DPADD) && !empty(DPADD) + echo ${SHLIB_NAME}: ${DPADD} >> ${DEPENDFILE} +.endif +.endif + +.if !target(install) + +.if defined(PRECIOUSLIB) +.if !defined(NO_FSCHG) +SHLINSTALLFLAGS+= -fschg +.endif +SHLINSTALLFLAGS+= -S +.endif + +_INSTALLFLAGS:= ${INSTALLFLAGS} +.for ie in ${INSTALLFLAGS_EDIT} +_INSTALLFLAGS:= ${_INSTALLFLAGS${ie}} +.endfor +_SHLINSTALLFLAGS:= ${SHLINSTALLFLAGS} +.for ie in ${INSTALLFLAGS_EDIT} +_SHLINSTALLFLAGS:= ${_SHLINSTALLFLAGS${ie}} +.endfor + +.if !defined(INTERNALLIB) +realinstall: _libinstall +.ORDER: beforeinstall _libinstall +_libinstall: +.if defined(LIB) && !empty(LIB) && ${MK_INSTALLLIB} != "no" + ${INSTALL} -C -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \ + ${_INSTALLFLAGS} lib${LIB}.a ${DESTDIR}${_LIBDIR} +.endif +.if ${MK_PROFILE} != "no" && defined(LIB) && !empty(LIB) + ${INSTALL} -C -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \ + ${_INSTALLFLAGS} lib${LIB}_p.a ${DESTDIR}${_LIBDIR} +.endif +.if defined(SHLIB_NAME) + ${INSTALL} ${STRIP} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \ + ${_INSTALLFLAGS} ${_SHLINSTALLFLAGS} \ + ${SHLIB_NAME} ${DESTDIR}${_SHLIBDIR} +.if ${MK_DEBUG_FILES} != "no" +.if defined(DEBUGMKDIR) + ${INSTALL} -T debug -d ${DESTDIR}${DEBUGFILEDIR} +.endif + ${INSTALL} -T debug -o ${LIBOWN} -g ${LIBGRP} -m ${DEBUGMODE} \ + ${_INSTALLFLAGS} \ + ${SHLIB_NAME}.debug ${DESTDIR}${DEBUGFILEDIR} +.endif +.if defined(SHLIB_LINK) +# ${_SHLIBDIRPREFIX} and ${_LDSCRIPTROOT} are both needed when cross-building +# and when building 32 bits library shims. ${_SHLIBDIRPREFIX} is the directory +# prefix where shared objects will be installed by the install target. +# +# ${_LDSCRIPTROOT} is the directory prefix that will be used when generating +# ld(1) scripts. The crosstools' ld is configured to lookup libraries in an +# alternative directory which is called "sysroot", so during buildworld binaries +# won't be linked against the running system libraries but against the ones of +# the current source tree. ${_LDSCRIPTROOT} behavior is twisted because of +# the location where we store them: +# - 64 bits libs are located under sysroot, so ${_LDSCRIPTROOT} must be empty +# because ld(1) will manage to find them from sysroot; +# - 32 bits shims are not, so ${_LDSCRIPTROOT} is used to specify their full +# path, outside of sysroot. +# Note that ld(1) scripts are generated both during buildworld and +# installworld; in the later case ${_LDSCRIPTROOT} must be obviously empty +# because on the target system, libraries are meant to be looked up from /. +.if defined(SHLIB_LDSCRIPT) && !empty(SHLIB_LDSCRIPT) && exists(${.CURDIR}/${SHLIB_LDSCRIPT}) + sed -e 's,@@SHLIB@@,${_LDSCRIPTROOT}${_SHLIBDIR}/${SHLIB_NAME},g' \ + -e 's,@@LIBDIR@@,${_LDSCRIPTROOT}${_LIBDIR},g' \ + ${.CURDIR}/${SHLIB_LDSCRIPT} > ${DESTDIR}${_LIBDIR}/${SHLIB_LINK:R}.ld + ${INSTALL} -S -C -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \ + ${_INSTALLFLAGS} ${DESTDIR}${_LIBDIR}/${SHLIB_LINK:R}.ld \ + ${DESTDIR}${_LIBDIR}/${SHLIB_LINK} + rm -f ${DESTDIR}${_LIBDIR}/${SHLIB_LINK:R}.ld + +.else +.if ${_SHLIBDIR} == ${_LIBDIR} + ${INSTALL_SYMLINK} ${SHLIB_NAME} ${DESTDIR}${_LIBDIR}/${SHLIB_LINK} +.else + ${INSTALL_SYMLINK} ${_SHLIBDIRPREFIX}${_SHLIBDIR}/${SHLIB_NAME} \ + ${DESTDIR}${_LIBDIR}/${SHLIB_LINK} +.if exists(${DESTDIR}${_LIBDIR}/${SHLIB_NAME}) + -chflags noschg ${DESTDIR}${_LIBDIR}/${SHLIB_NAME} + rm -f ${DESTDIR}${_LIBDIR}/${SHLIB_NAME} +.endif +.endif +.endif # SHLIB_LDSCRIPT +.endif # SHLIB_LINK +.endif # SHIB_NAME +.if defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB) && ${MK_TOOLCHAIN} != "no" + ${INSTALL} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \ + ${_INSTALLFLAGS} lib${LIB}_pic.a ${DESTDIR}${_LIBDIR} +.endif +.if defined(WANT_LINT) && !defined(NO_LINT) && defined(LIB) && !empty(LIB) + ${INSTALL} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \ + ${_INSTALLFLAGS} ${LINTLIB} ${DESTDIR}${LINTLIBDIR} +.endif +.endif # !defined(INTERNALLIB) + +.if !defined(LIBRARIES_ONLY) +.include +.include +.include +.endif + +.include + +.if ${MK_MAN} != "no" && !defined(LIBRARIES_ONLY) +realinstall: _maninstall +.ORDER: beforeinstall _maninstall +.endif + +.endif + +.if !target(lint) +lint: ${SRCS:M*.c} + ${LINT} ${LINTFLAGS} ${CFLAGS:M-[DIU]*} ${.ALLSRC} +.endif + +.if ${MK_MAN} != "no" && !defined(LIBRARIES_ONLY) +.include +.endif + +.include + +.if !exists(${.OBJDIR}/${DEPENDFILE}) +.if defined(LIB) && !empty(LIB) +${OBJS} ${STATICOBJS} ${POBJS}: ${SRCS:M*.h} +.for _S in ${SRCS:N*.[hly]} +${_S:R}.po: ${_S} +.endfor +.endif +.if defined(SHLIB_NAME) || \ + defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB) +${SOBJS}: ${SRCS:M*.h} +.for _S in ${SRCS:N*.[hly]} +${_S:R}.So: ${_S} +.endfor +.endif +.endif + +.if !target(clean) +clean: +.if defined(CLEANFILES) && !empty(CLEANFILES) + rm -f ${CLEANFILES} +.endif +.if defined(LIB) && !empty(LIB) + rm -f a.out ${OBJS} ${OBJS:S/$/.tmp/} ${STATICOBJS} +.endif +.if !defined(INTERNALLIB) +.if ${MK_PROFILE} != "no" && defined(LIB) && !empty(LIB) + rm -f ${POBJS} ${POBJS:S/$/.tmp/} +.endif +.if defined(SHLIB_NAME) || \ + defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB) + rm -f ${SOBJS} ${SOBJS:.So=.so} ${SOBJS:S/$/.tmp/} +.endif +.if defined(SHLIB_NAME) +.if defined(SHLIB_LINK) +.if defined(SHLIB_LDSCRIPT) && exists(${.CURDIR}/${SHLIB_LDSCRIPT}) + rm -f lib${LIB}.ld +.endif + rm -f ${SHLIB_LINK} +.endif +.endif # defined(SHLIB_NAME) +.if defined(WANT_LINT) && defined(LIB) && !empty(LIB) + rm -f ${LINTOBJS} +.endif +.endif # !defined(INTERNALLIB) +.if defined(_LIBS) && !empty(_LIBS) + rm -f ${_LIBS} +.endif +.if defined(CLEANDIRS) && !empty(CLEANDIRS) + rm -rf ${CLEANDIRS} +.endif +.if !empty(VERSION_DEF) && !empty(SYMBOL_MAPS) + rm -f ${VERSION_MAP} +.endif +.endif + +.include + +.include