Use Painless Security signing key
[freeradius.git] / configure.ac
index a118c57..9ead51d 100644 (file)
@@ -33,15 +33,11 @@ dnl #
 dnl #  Custom hackery to discover version at configure time
 dnl #
 dnl #############################################################
+RADIUSD_MAJOR_VERSION=`cat VERSION | cut -f1 -d.`
+RADIUSD_MINOR_VERSION=`cat VERSION | cut -f2 -d.`
+RADIUSD_INCRM_VERSION=`cat VERSION | cut -f3 -d. | sed 's/[[\.-]].*$//'`
 
-RADIUSD_MAJOR_VERSION=`cat VERSION | sed 's/\..*//'`
-RADIUSD_MINOR_VERSION=`cat VERSION | sed 's/^[[^\.]]*\.//' | sed 's/\..*$//'`
-RADIUSD_INCRM_VERSION=`cat VERSION | sed 's/^.*\..*\.//' | sed 's/[[\.-]].*$//'`
-
-RADIUSD_VERSION=`echo | awk -v major="$RADIUSD_MAJOR_VERSION" \
--v minor="$RADIUSD_MINOR_VERSION" \
--v incrm="$RADIUSD_INCRM_VERSION" \
-'{ printf "%02i%02i%02i", major, minor, incrm }'`
+RADIUSD_VERSION=`printf "%02i%02i%02i" $RADIUSD_MAJOR_VERSION $RADIUSD_MINOR_VERSION $RADIUSD_INCRM_VERSION`
 
 dnl #
 dnl #  Still useful for custom builds
@@ -90,7 +86,7 @@ if test -d $srcdir/.git; then
   if test "x$developer" != "xno"; then
     AC_MSG_NOTICE([found .git directory, enabling developer build implicitly, disable with --disable-developer])
     developer="yes"
-  fi  
+  fi
 fi
 
 dnl #
@@ -134,12 +130,18 @@ dnl #
 dnl #  Definitive check for whether the compiler is clang
 dnl #
 AX_CC_IS_CLANG
+if test "x$ax_cv_cc_clang" = "xyes"; then
+  AC_SUBST(clang_path, "$CC")
+else
+  AC_SUBST(clang_path, "")
+fi
+
 
 dnl #
 dnl #  Set Default CFLAGS for GCC compatible compilers
 dnl #
 if test "x$GCC" = "xyes"; then
-  CFLAGS="$CFLAGS -Wall -D_GNU_SOURCE"
+  CFLAGS="$CFLAGS -Wall -std=c99 -D_GNU_SOURCE"
 fi
 
 dnl #
@@ -149,7 +151,7 @@ AX_CC_QUNUSED_ARGUMENTS_FLAG
 if test "x$ax_cv_cc_qunused_arguments_flag" = "xyes"; then
   CFLAGS="$CFLAGS -Qunused-arguments"
   LDFLAGS="$LDFLAGS -Qunused-arguments"
-fi 
+fi
 
 dnl #
 dnl #  Compile in large (2G+) file support.
@@ -160,7 +162,10 @@ dnl #
 dnl #  check for system bytesex
 dnl #  AC_DEFINES WORDS_BIGENDIAN
 dnl #
-AC_C_BIGENDIAN
+AC_C_BIGENDIAN(
+  [AC_DEFINE(FR_BIG_ENDIAN, 1, [Define if your processor stores words with the most significant byte first])],
+  [AC_DEFINE(FR_LITTLE_ENDIAN, 1, [Define if your processor stores words with the least significant byte first])]
+)
 
 dnl #
 dnl #  Find GNU Make.
@@ -176,8 +181,8 @@ if test -z "$makever"; then
   AC_MSG_ERROR([GNU Make is not installed.  Please download and install it from ftp://prep.ai.mit.edu/pub/gnu/make/ before continuing.])
 fi
 
-dnl #  
-dnl #  autoconf explicitly sets MAKEFLAGS and MFLAGS to '' even though we 
+dnl #
+dnl #  autoconf explicitly sets MAKEFLAGS and MFLAGS to '' even though we
 dnl #  didn't tell it to, so we have to use FR_MAKEFLAGS.
 dnl #
 dnl #  determine the number of cores available and set the number of build
@@ -317,7 +322,31 @@ AC_ARG_WITH(raddbdir,
 AC_SUBST(raddbdir)
 AC_MSG_RESULT($raddbdir)
 
-modconfdir="$raddbdir/mods-config"
+dnl #
+dnl #  extra argument: --with-dictdir
+dnl #
+dictdir='${datarootdir}/freeradius'
+AC_MSG_CHECKING(dictdir)
+AC_ARG_WITH(dictdir,
+[  --with-dictdir=DIR      directory for dictionary files [DATAROOTDIR/freeradius] ],
+[ case "$withval" in
+  no)
+    AC_MSG_ERROR([Need dictdir])
+    ;;
+  yes)
+    ;;
+  [[\\/$]]* | ?:[[\\/]]* )
+    dictdir="$withval"
+    ;;
+  *)
+    AC_MSG_ERROR([expected an absolute directory name for --with-dictdir: $withval])
+    ;;
+  esac ]
+)
+AC_SUBST(dictdir)
+AC_MSG_RESULT($dictdir)
+
+modconfdir='${raddbdir}/mods-config'
 AC_SUBST(modconfdir)
 
 dnl #
@@ -342,7 +371,7 @@ dnl #  extra argument: --with-threads
 dnl #
 WITH_THREADS=yes
 AC_ARG_WITH(threads,
-[  --with-threads          Use threads, if available.  (default=yes) ],
+[  --with-threads          use threads, if available.  (default=yes) ],
 [ case "$withval" in
   yes)
     ;;
@@ -356,7 +385,7 @@ dnl #  extra argument: --with-tcp
 dnl #
 WITH_TCP=yes
 AC_ARG_WITH(tcp,
-[  --with-tcp              Compile in TCP support. (default=yes)],
+[  --with-tcp              compile in TCP support. (default=yes)],
 [ case "$withval" in
   yes)
     ;;
@@ -373,7 +402,7 @@ dnl #  extra argument: --with-vmps
 dnl #
 WITH_VMPS=yes
 AC_ARG_WITH(vmps,
-[  --with-vmps             Compile in VMPS support. (default=yes)],
+[  --with-vmps             compile in VMPS support. (default=yes)],
 [ case "$withval" in
   yes)
     ;;
@@ -390,7 +419,7 @@ dnl #  extra argument: --with-dhcp
 dnl #
 WITH_DHCP=yes
 AC_ARG_WITH(dhcp,
-[  --with-dhcp             Compile in DHCP support. (default=yes)],
+[  --with-dhcp             compile in DHCP support. (default=yes)],
 [ case "$withval" in
   yes)
     ;;
@@ -414,6 +443,18 @@ AC_ARG_WITH(static_modules,
   done
 ])
 
+USE_SHARED_LIBS=yes
+AC_ARG_WITH(shared-libs,
+[AS_HELP_STRING([--with-shared-libs ],
+[build dynamic libraries and link against them. (default=yes)])],
+[ case "$withval" in
+  no)
+    USE_SHARED_LIBS=no
+    ;;
+  *)
+  esac
+])
+
 MODULES=
 AC_ARG_WITH(modules,
 [  --with-modules=QUOTED-MODULE-LIST],[
@@ -427,7 +468,8 @@ dnl #  extra argument: --with-experimental-modules
 dnl #
 EXPERIMENTAL=
 AC_ARG_WITH(experimental-modules,
-[  --with-experimental-modules      Use experimental and unstable modules. (default=no, unless --enable-developer=yes) ],
+[AS_HELP_STRING([--with-experimental-modules],
+[use experimental and unstable modules. (default=no, unless --enable-developer=yes)])],
 [ case "$withval" in
   yes)
     EXPERIMENTAL=yes
@@ -440,91 +482,121 @@ AC_ARG_WITH(experimental-modules,
 )
 
 dnl #
-dnl #  extra argument: --with-openssl
+dnl #  extra argument: --with-udpfromto
 dnl #
-WITH_OPENSSL=yes
-AC_ARG_WITH(openssl,
-[  --with-openssl                   Use OpenSSL. (default=yes)],
+WITH_UDPFROMTO=yes
+AC_ARG_WITH(udpfromto,
+[  --with-udpfromto        compile in UDPFROMTO support. (default=yes)],
 [ case "$withval" in
-  no)
-    WITH_OPENSSL=no
+  yes)
+    WITH_UDPFROMTO=yes
     ;;
   *)
-    WITH_OPENSSL=yes
-    ;;
+    WITH_UDPFROMTO=no
   esac ]
 )
 
+if test "x$WITH_UDPFROMTO" = "xyes"; then
+  AC_DEFINE(WITH_UDPFROMTO, [], [define if you want udpfromto])
+fi
+
 dnl #
-dnl #  extra argument: --with-openssl-includes=dir
+dnl #  These next two arguments don't actually do anything.  They're
+dnl #  place holders so that the top-level configure script can tell
+dnl #  the user how to configure lower-level modules
 dnl #
-OPENSSL_INCLUDE_DIR=
-AC_ARG_WITH(openssl-includes,
-[  --with-openssl-includes=DIR      Directory to look for OpenSSL include files],
+
+dnl #
+dnl #  extra argument: --with-rlm-FOO-lib-dir
+dnl #
+AC_ARG_WITH(rlm-FOO-lib-dir,
+[AS_HELP_STRING([--with-rlm-FOO-lib-dir=DIR],
+[directory in which to look for library files used by module FOO])],
 [ case "$withval" in
-  *) OPENSSL_INCLUDE_DIR="$withval"
+  *)
     ;;
   esac ]
 )
 
 dnl #
-dnl #  extra argument: --with-openssl-libraries=dir
+dnl #  extra argument: --with-rlm-FOO-include-dir
 dnl #
-OPENSSL_LIB_DIR=
-AC_ARG_WITH(openssl-libraries,
-[  --with-openssl-libraries=DIR     Directory to look for OpenSSL library files],
+AC_ARG_WITH(rlm-FOO-include-dir,
+[AS_HELP_STRING([--with-rlm-FOO-include-dir=DIR],
+[directory in which to look for include files used by module FOO])],
 [ case "$withval" in
-  *) OPENSSL_LIB_DIR="$withval"
+  *)
     ;;
   esac ]
 )
 
 dnl #
-dnl #  These next two arguments don't actually do anything.  They're
-dnl #  place holders so that the top-level configure script can tell
-dnl #  the user how to configure lower-level modules
-dnl #
-
-dnl #
-dnl #  extra argument: --with-rlm-FOO-lib-dir
+dnl #  extra argument: --with-openssl
 dnl #
-AC_ARG_WITH(rlm-FOO-lib-dir,
-[  --with-rlm-FOO-lib-dir=DIR       Directory to look for library files used by module FOO],
+WITH_OPENSSL=yes
+AC_ARG_WITH(openssl,
+[  --with-openssl          use OpenSSL. (default=yes)],
 [ case "$withval" in
+  no)
+    WITH_OPENSSL=no
+    ;;
   *)
+    WITH_OPENSSL=yes
     ;;
   esac ]
 )
 
 dnl #
-dnl #  extra argument: --with-rlm-FOO-include-dir
+dnl #  extra argument: --with-openssl-lib-dir=dir
 dnl #
-AC_ARG_WITH(rlm-FOO-include-dir,
-[  --with-rlm-FOO-include-dir=DIR   Directory to look for include files used by module FOO],
+openssl_lib_dir=
+AC_ARG_WITH(openssl-lib-dir,
+[AS_HELP_STRING([--with-openssl-lib-dir=DIR],
+[directory to look for OpenSSL library files])],
 [ case "$withval" in
-  *)
+  *) openssl_lib_dir="$withval"
     ;;
   esac ]
 )
 
-dnl # 
-dnl #  extra argument: --with-udpfromto
 dnl #
-WITH_UDPFROMTO=no
-AC_ARG_WITH(udpfromto,
-[  --with-udpfromto        Compile in UDPFROMTO support. (default=no)],
+dnl #  extra argument: --with-openssl-includes=dir
+dnl #
+openssl_include_dir=
+AC_ARG_WITH(openssl-include-dir,
+[AS_HELP_STRING([--with-openssl-include-dir=DIR],
+[directory to look for OpenSSL include files])],
 [ case "$withval" in
-  yes)
-    WITH_UDPFROMTO=yes
+  *) openssl_include_dir="$withval"
     ;;
-  *)
-    WITH_UDPFROMTO=no
   esac ]
 )
 
-if test "x$WITH_UDPFROMTO" = "xyes"; then
-  AC_DEFINE(WITH_UDPFROMTO, [], [define if you want udpfromto])
+dnl #
+dnl #  extra argument: --disable-openssl-version-check
+dnl #
+AC_ARG_ENABLE(openssl-version-check,
+[AS_HELP_STRING([--disable-openssl-version-check],
+                [disable vulnerable OpenSSL version check])]
+)
+if test "x$enable_openssl_version_check" != "xno"; then
+  AC_DEFINE(ENABLE_OPENSSL_VERSION_CHECK, [1],
+            [Define to 1 to have OpenSSL version check enabled])
+  openssl_version_check_config="\
+       #
+       #  allow_vulnerable_openssl: Allow the server to start with
+       #  versions of OpenSSL known to have critical vulnerabilities.
+       #
+       #  This check is based on the version number reported by libssl
+       #  and may not reflect patches applied to libssl by
+       #  distribution maintainers.
+       #
+       allow_vulnerable_openssl = no"
+else
+  openssl_version_check_config=
 fi
+AC_SUBST([openssl_version_check_config])
+
 
 dnl #############################################################
 dnl #
@@ -567,6 +639,52 @@ dnl #  2. Checks for libraries
 dnl #
 dnl #############################################################
 
+dnl Check for talloc
+dnl extra argument: --with-talloc-lib-dir=DIR
+talloc_lib_dir=
+AC_ARG_WITH(talloc-lib-dir,
+  [AS_HELP_STRING([--with-talloc-lib-dir=DIR],
+  [directory in which to look for talloc library files])],
+  [case "$withval" in
+    no)
+      AC_MSG_ERROR([Need talloc-lib-dir])
+      ;;
+    yes)
+      ;;
+    *)
+      talloc_lib_dir="$withval"
+      ;;
+  esac])
+
+dnl extra argument: --with-talloc-include-dir=DIR
+talloc_include_dir=
+AC_ARG_WITH(talloc-include-dir,
+  [AS_HELP_STRING([--with-talloc-include-dir=DIR],
+  [directory in which to look for talloc include files])],
+  [case "$withval" in
+    no)
+      AC_MSG_ERROR([Need talloc-include-dir])
+      ;;
+    yes)
+      ;;
+    *)
+      talloc_include_dir="$withval"
+      ;;
+  esac])
+
+smart_try_dir="$talloc_lib_dir"
+FR_SMART_CHECK_LIB(talloc, _talloc)
+if test "x$ac_cv_lib_talloc__talloc" != "xyes"; then
+  AC_MSG_WARN([talloc library not found. Use --with-talloc-lib-dir=<path>.])
+  AC_MSG_ERROR([FreeRADIUS requires libtalloc])
+fi
+
+TALLOC_LIBS="${smart_lib}"
+TALLOC_LDFLAGS="${smart_ldflags}"
+AC_SUBST(TALLOC_LIBS)
+AC_SUBST(TALLOC_LDFLAGS)
+LIBS="$old_LIBS"
+
 dnl #
 dnl #  If using pthreads, check for -lpthread (posix) or -lc_r (*BSD)
 dnl #
@@ -576,7 +694,11 @@ if test "x$WITH_THREADS" = "xyes"; then
     CFLAGS="$CFLAGS -mt"
   fi
 
-  AC_CHECK_HEADERS(pthread.h, [], [ WITH_THREADS="no" ])
+  AC_CHECK_HEADERS(pthread.h, [],
+    [
+      WITH_THREADS="no"
+      fail=[pthread.h]
+    ])
 
   dnl #
   dnl #  pthread stuff is usually in -lpthread
@@ -585,18 +707,58 @@ if test "x$WITH_THREADS" = "xyes"; then
   dnl #  On Some systems, we need extra pre-processor flags, to get them to
   dnl #  to do the threading properly.
   dnl #
-  AC_CHECK_LIB(pthread, pthread_create,
-    [
-      CFLAGS="$CFLAGS -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS"
-      LIBS="-lpthread $LIBS"
-    ],
-    [
+  if test "x$WITH_THREADS" != "xno"; then
+    AC_CHECK_LIB(pthread, pthread_create,
+      [
+        HAVE_LPTHREAD='yes'
+        CFLAGS="$CFLAGS -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS"
+        LIBS="-lpthread $LIBS"
+
+        dnl #
+        dnl #  -pthread should add all required CPP definitions and linker
+        dnl #  arguments. But not all compilers support it, or some compilers
+        dnl #  only support it on certain platforms.
+        dnl #
+        AX_CC_PTHREAD_FLAG
+        if test "x$ax_cv_cc_pthread_flag" != 'xyes'; then
+          CFLAGS="$CFLAGS -pthread"
+        fi
+      ]
+    )
+
+    dnl #
+    dnl #  Check for libc_r which used to be the threading library used
+    dnl #  for FreeBSD. Internet says it may be deprecated, but if we
+    dnl #  can't find lpthread it's probably worth checking.
+    dnl #
+    if test "x$HAVE_LPTHREAD" != "xyes"; then
       AC_CHECK_LIB(c_r, pthread_create,
-        [ CFLAGS="$CFLAGS -pthread -D_THREAD_SAFE" ],
-        [ WITH_THREADS="no" ]
+        [
+          CFLAGS="$CFLAGS -D_THREAD_SAFE"
+
+          dnl #
+          dnl #  -pthread should add all required CPP definitions and linker
+          dnl #  arguments. But not all compilers support it, or some compilers
+          dnl #  only support it on certain platforms.
+          dnl #
+          AX_CC_PTHREAD_FLAG
+          if test "x$ax_cv_cc_pthread_flag" != 'xyes'; then
+            LIBS="-lc_r $LIBS"
+          else
+            CFLAGS="$CFLAGS -pthread"
+          fi
+        ],
+        [ fail=[-lc_r or -lpthread] ]
       )
-    ]
-  )
+    fi
+  fi
+
+  if test "x$WITH_THREADS" != "xyes"; then
+    AC_MSG_WARN([silently not building with thread support.])
+    AC_MSG_WARN([FAILURE: thread support requires: $fail.])
+  else
+    AC_DEFINE(WITH_THREADS, [1], [define if you want thread support])
+  fi
 fi
 
 dnl #
@@ -623,12 +785,8 @@ else
   )
 fi
 
-if test "x$WITH_THREADS" = "xyes"; then
-  AC_DEFINE(WITH_THREADS, [1], [define if you want thread support])
-fi
-
 dnl #
-dnl #  Check if we need -lsocket
+dnl #  Check if we have -ldl
 dnl #
 AC_CHECK_LIB(dl, dlopen)
 
@@ -653,18 +811,147 @@ AC_CHECK_LIB(ws2_32, htonl)
 dnl #
 dnl #  Check the pcap library for the RADIUS sniffer.
 dnl #
-PCAP_LIBS=
-AC_CHECK_LIB(pcap, pcap_open_live,
-  [
-    PCAP_LIBS="-lpcap"
-    AC_DEFINE(HAVE_LIBPCAP, 1,
-      [Define to 1 if you have the `pcap' library (-lpcap).]
-    )
-  ],
-  [
-    AC_MSG_WARN([pcap library not found, silently disabling the RADIUS sniffer.])
-  ]
-)
+dnl extra argument: --with-pcap-lib-dir=DIR
+pcap_lib_dir=
+AC_ARG_WITH(pcap-lib-dir,
+  [AS_HELP_STRING([--with-pcap-lib-dir=DIR],
+  [directory in which to look for pcap library files])],
+  [case "$withval" in
+    no)
+      AC_MSG_ERROR([Need pcap-lib-dir])
+      ;;
+    yes)
+      ;;
+    *)
+      pcap_lib_dir="$withval"
+      ;;
+  esac])
+
+dnl extra argument: --with-pcap-include-dir=DIR
+pcap_include_dir=
+AC_ARG_WITH(pcap-include-dir,
+  [AS_HELP_STRING([--with-pcap-include-dir=DIR],
+  [directory in which to look for pcap include files])],
+  [case "$withval" in
+    no)
+      AC_MSG_ERROR([Need pcap-include-dir])
+      ;;
+    yes)
+      ;;
+    *)
+      pcap_include_dir="$withval"
+      ;;
+  esac])
+
+smart_try_dir="$pcap_lib_dir"
+FR_SMART_CHECK_LIB(pcap, pcap_open_live)
+if test "x$ac_cv_lib_pcap_pcap_open_live" != "xyes"; then
+  AC_MSG_WARN([pcap library not found, silently disabling the RADIUS sniffer, and ARP listener.  Use --with-pcap-lib-dir=<path>.])
+else
+  AC_DEFINE(HAVE_LIBPCAP, 1,
+    [Define to 1 if you have the `pcap' library (-lpcap).]
+  )
+
+  AC_CHECK_FUNCS(\
+    pcap_fopen_offline \
+    pcap_dump_fopen \
+    pcap_create \
+    pcap_activate
+  )
+
+  PCAP_LIBS="${smart_lib}"
+  PCAP_LDFLAGS="${smart_ldflags}"
+fi
+dnl Set by FR_SMART_CHECK_LIB
+LIBS="${old_LIBS}"
+
+dnl Check for collectdclient
+dnl extra argument: --with-collectdclient-lib-dir=DIR
+collectdclient_lib_dir=
+AC_ARG_WITH(collectdclient-lib-dir,
+  [AS_HELP_STRING([--with-collectdclient-lib-dir=DIR],
+  [directory in which to look for collectdclient library files])],
+  [case "$withval" in
+    no)
+      AC_MSG_ERROR([Need collectdclient-lib-dir])
+      ;;
+    yes)
+      ;;
+    *)
+      collectdclient_lib_dir="$withval"
+      ;;
+  esac])
+
+dnl extra argument: --with-collectdclient-include-dir=DIR
+collectdclient_include_dir=
+AC_ARG_WITH(collectdclient-include-dir,
+  [AS_HELP_STRING([--with-collectdclient-include-dir=DIR],
+  [directory in which to look for collectdclient include files])],
+  [case "$withval" in
+    no)
+      AC_MSG_ERROR([Need collectdclient-include-dir])
+      ;;
+    yes)
+      ;;
+    *)
+      collectdclient_include_dir="$withval"
+      ;;
+  esac])
+
+smart_try_dir="$collectdclient_lib_dir"
+FR_SMART_CHECK_LIB(collectdclient, lcc_connect)
+if test "x$ac_cv_lib_collectdclient_lcc_connect" != "xyes"; then
+  AC_MSG_WARN([collectdclient library not found. Use --with-collectdclient-lib-dir=<path>.])
+else
+  COLLECTDC_LIBS="${smart_lib}"
+  COLLECTDC_LDFLAGS="${smart_ldflags}"
+fi
+dnl Set by FR_SMART_CHECKLIB
+LIBS="${old_LIBS}"
+
+dnl Check for cap
+dnl extra argument: --with-cap-lib-dir=DIR
+cap_lib_dir=
+AC_ARG_WITH(cap-lib-dir,
+  [AS_HELP_STRING([--with-cap-lib-dir=DIR],
+  [directory in which to look for cap library files])],
+  [case "$withval" in
+    no)
+      AC_MSG_ERROR([Need cap-lib-dir])
+      ;;
+    yes)
+      ;;
+    *)
+      cap_lib_dir="$withval"
+      ;;
+  esac])
+
+dnl extra argument: --with-cap-include-dir=DIR
+cap_include_dir=
+AC_ARG_WITH(cap-include-dir,
+  [AS_HELP_STRING([--with-cap-include-dir=DIR],
+  [directory in which to look for cap include files])],
+  [case "$withval" in
+    no)
+      AC_MSG_ERROR([Need cap-include-dir])
+      ;;
+    yes)
+      ;;
+    *)
+      cap_include_dir="$withval"
+      ;;
+  esac])
+
+smart_try_dir="$cap_lib_dir"
+FR_SMART_CHECK_LIB(cap, cap_get_proc)
+if test "x$ac_cv_lib_cap_cap_get_proc" != "xyes"; then
+  AC_MSG_WARN([cap library not found, debugger checks will not be enabled. Use --with-cap-lib-dir=<path>.])
+else
+  AC_DEFINE(HAVE_LIBCAP, 1,
+    [Define to 1 if you have the `cap' library (-lcap).]
+  )
+  HAVE_LIBCAP=1
+fi
 
 VL_LIB_READLINE
 
@@ -675,10 +962,19 @@ dnl #
 dnl #############################################################
 
 dnl #
+dnl # Check for talloc header files
+dnl #
+smart_try_dir="$talloc_include_dir"
+FR_SMART_CHECK_INCLUDE([talloc.h])
+if test "x$ac_cv_header_talloc_h" != "xyes"; then
+  AC_MSG_WARN([talloc headers not found. Use --with-talloc-include-dir=<path>.])
+  AC_MSG_ERROR([FreeRADIUS requires libtalloc])
+fi
+
+dnl #
 dnl #  Interix requires us to set -D_ALL_SOURCE, otherwise
 dnl #  getopt will be #included, but won't link.  <sigh>
 dnl #
-dnl #
 case "$host" in
   *-interix*)
     CFLAGS="$CFLAGS -D_ALL_SOURCE"
@@ -686,6 +982,7 @@ case "$host" in
   *-darwin*)
     CFLAGS="$CFLAGS -DDARWIN"
     LIBS="-framework DirectoryService $LIBS"
+    AC_DEFINE([__APPLE_USE_RFC_3542], 1, [Force OSX >= 10.7 Lion to use RFC2292 IPv6 socket options])
     ;;
 esac
 
@@ -695,133 +992,63 @@ AC_HEADER_TIME
 AC_HEADER_SYS_WAIT
 
 AC_CHECK_HEADERS( \
-  dlfcn.h \
-  unistd.h \
+  arpa/inet.h \
   crypt.h \
+  dlfcn.h \
   errno.h \
-  resource.h \
-  sys/resource.h \
+  fcntl.h \
+  features.h \
+  fnmatch.h \
   getopt.h \
-  malloc.h \
-  utmp.h \
-  utmpx.h \
-  signal.h \
-  sys/select.h \
-  syslog.h \
+  glob.h \
+  grp.h \
   inttypes.h \
-  stdint.h \
-  stdio.h \
+  limits.h \
+  malloc.h \
   netdb.h \
-  semaphore.h \
-  arpa/inet.h \
   netinet/in.h \
-  sys/types.h \
-  sys/socket.h \
-  winsock.h \
-  utime.h \
-  sys/time.h \
-  sys/wait.h \
-  sys/security.h \
-  fcntl.h \
-  sys/fcntl.h \
-  sys/prctl.h \
-  sys/un.h \
-  glob.h \
   prot.h \
   pwd.h \
-  grp.h \
-  stddef.h \
-  fnmatch.h \
+  resource.h \
+  semaphore.h \
   sia.h \
-  siad.h
+  siad.h \
+  signal.h \
+  stdbool.h \
+  stddef.h \
+  stdint.h \
+  stdio.h \
+  sys/event.h \
+  sys/fcntl.h \
+  sys/prctl.h \
+  sys/ptrace.h \
+  sys/resource.h \
+  sys/security.h \
+  sys/select.h \
+  sys/socket.h \
+  sys/time.h \
+  sys/types.h \
+  sys/un.h \
+  sys/wait.h \
+  syslog.h \
+  unistd.h \
+  utime.h \
+  utmp.h \
+  utmpx.h \
+  winsock.h
 )
 
 dnl #
 dnl #  FreeBSD requires sys/socket.h before net/if.h
 dnl #
 AC_CHECK_HEADERS(net/if.h, [], [],
-[#ifdef HAVE_SYS_SOCKET_H
-#  include <sys/socket.h>
-#  endif
-])
-
-dnl #
-dnl #  Check for regular expression support
-dnl #
-dnl extra argument: --with-pcre-lib-dir
-pcre_lib_dir=
-AC_ARG_WITH(rlm-pcre-lib-dir,
-[  --with-pcre-lib-dir=DIR       directory for PCRE library files []],
-[ case "$withval" in
-    no)
-       AC_MSG_ERROR(Need rlm-pcre-lib-dir)
-       ;;
-    yes)
-       ;;
-    *)
-       pcre_lib_dir="$withval"
-       ;;
-  esac ]
-)
-
-dnl extra argument: --with-pcre-include--dir
-pcre_include_dir=
-AC_ARG_WITH(rlm-pcre-include-dir,
-[  --with-pcre-include-dir=DIR   directory for PCRE include files []],
-[ case "$withval" in
-    no)
-       AC_MSG_ERROR(Need rlm-pcre-include-dir)
-       ;;
-    yes)
-       ;;
-    *)
-       pcre_include_dir="$withval"
-       ;;
-  esac ]
+  [
+    #ifdef HAVE_SYS_SOCKET_H
+    #  include <sys/socket.h>
+    #endif
+  ]
 )
 
-REGEX=no
-REGEX_EXTENDED=no
-REGEX_PCRE=no
-
-dnl #
-dnl #  First look for PCRE
-dnl #
-smart_try_dir=$pcre_include_dir
-FR_SMART_CHECK_INCLUDE(pcreposix.h)
-if test "x$ac_cv_header_pcreposix_h" = "xyes"; then
-  AC_DEFINE(HAVE_REGEX_H, [1], [define if we have any regex])
-  AC_DEFINE(HAVE_PCREPOSIX_H, [1], [define this if we have the <pcreposix.h> header file])
-  REGEX=yes
-  REGEX_EXTENDED=yes
-  REGEX_PCRE=yes
-  LIBS="$LIBS -lpcre -lpcreposix"
-  
-dnl #
-dnl #  Then fallback to POSIX regular expressions
-dnl #
-else
-  smart_try_dir=
-  FR_SMART_CHECK_INCLUDE(regex.h)
-  if test "x$ac_cv_header_regex_h" = "xyes"; then
-    AC_DEFINE(HAVE_REGEX_H, [1], [define if we have any regex])
-    REGEX=yes
-    AC_EGREP_CPP(yes,
-      [
-        #include <regex.h>
-        #ifdef REG_EXTENDED
-        yes
-        #endif
-       ],
-    [AC_DEFINE(HAVE_REG_EXTENDED, [1], [define this if we have REG_EXTENDED (from <regex.h>)]) REGEX_EXTENDED=yes]
-    )
-  fi
-fi
-
-AC_SUBST(REGEX)
-AC_SUBST(REGEX_PCRE)
-AC_SUBST(REGEX_EXTENDED)
-
 dnl #
 dnl #  other checks which require headers
 dnl #
@@ -839,125 +1066,140 @@ dnl #
 dnl #  Were we told to use OpenSSL, if we were and we find an error, call AC_MSG_FAILURE and exit
 dnl #
 if test "x$WITH_OPENSSL" = xyes; then
-  old_LIBS=$LIBS
-  old_LDFLAGS="$LDFLAGS"
-  
-  OPENSSL_INCLUDE="-DNO_OPENSSL"
-  OPENSSL_LIBS=
-  if test "x$OPENSSL_LIB_DIR" != "x"; then
-    LDFLAGS="$LDFLAGS -L$OPENSSL_LIB_DIR"
-  fi
+  OLD_LIBS="$LIBS"
 
   dnl #
-  dnl #  Check we can link to libssl
+  dnl #  Apparently OpenSSL will attempt to build with kerberos if we don't pass this?!
   dnl #
-  AC_CHECK_LIB(crypto, DH_new,
-    [
-      LIBS="-lcrypto $LIBS"
-      AC_DEFINE(HAVE_LIBCRYPTO, 1, [Define to 1 if you have the `crypto' library (-lcrypto).])
-      AC_CHECK_LIB(ssl, SSL_new,
-        [
-          AC_DEFINE(HAVE_LIBSSL, 1, [Define to 1 if you have the `ssl' library (-lssl).])
-          if test "x$OPENSSL_LIB_DIR" != "x"; then
-            OPENSSL_LIBS="-L$OPENSSL_LIB_DIR"
-          fi
-          OPENSSL_LIBS="$OPENSSL_LIBS -lcrypto -lssl -lcrypto"
-        ],
-        [
-          AC_MSG_FAILURE([failed linking to libssl])
-        ]
-      )
-    ],
-    []
-  )
+  CFLAGS="$CFLAGS -DOPENSSL_NO_KRB5"
 
   dnl #
-  dnl #  Check we can find required headers
-  dnl #
-  old_CPPFLAGS=$CPPFLAGS
-  if test "x$OPENSSL_INCLUDE_DIR" != "x"; then
-    CPPFLAGS="$CPPFLAGS -I$OPENSSL_INCLUDE_DIR"
-  fi
-  dnl # 
-  dnl #  Stupid RedHat shit
+  dnl #  Check we can link to libcrypto and libssl
   dnl #
-  CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_KRB5"
-  AC_CHECK_HEADERS( \
-    openssl/ssl.h \
-    openssl/crypto.h \
-    openssl/err.h \
-    openssl/evp.h \
-    openssl/md5.h \
-    openssl/md4.h \
-    openssl/sha.h \
-    openssl/ocsp.h \
-    openssl/engine.h,
-    [],
-    [
-      AC_MSG_FAILURE([failed locating OpenSSL headers])
-    ]
-  )
-  
-  AC_MSG_CHECKING([for OpenSSL version >= 0.9.7])
-  AC_EGREP_CPP(yes,
-    [#include <openssl/crypto.h>
-     #if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
-     yes
-     #endif
-    ],
-    [
-      AC_MSG_RESULT(yes)
-    ],
-    [
-      AC_MSG_RESULT(no)
-      AC_MSG_FAILURE([OpenSSL version too old])
-    ]
-  )
-
-  if test "x$OPENSSL_INCLUDE_DIR" != "x"; then
-    OPENSSL_INCLUDE="-I$OPENSSL_INCLUDE_DIR -DOPENSSL_NO_KRB5"
+  smart_try_dir="$openssl_lib_dir"
+  FR_SMART_CHECK_LIB(crypto, DH_new)
+  if test "x$ac_cv_lib_crypto_DH_new" = "xyes"; then
+    AC_DEFINE(HAVE_LIBCRYPTO, 1, [Define to 1 if you have the `crypto' library (-lcrypto).])
+    OPENSSL_LIBS="$smart_lib"
+    OPENSSL_LDFLAGS="$smart_ldflags"
+
+    FR_SMART_CHECK_LIB(ssl, SSL_new)
+    if test "x$ac_cv_lib_ssl_SSL_new" != "xyes"; then
+      AC_MSG_FAILURE([failed linking to libssl. Use --with-openssl-lib-dir=<path>, or --with-openssl=no (builds without OpenSSL)])
+    else
+      AC_DEFINE(HAVE_LIBSSL, 1, [Define to 1 if you have the `ssl' library (-lssl).])
+      OPENSSL_LIBS="$OPENSSL_LIBS $smart_lib"
+
+      if test "$OPENSSL_LDFLAGS" != "$smart_ldflags"; then
+        AC_MSG_FAILURE(["inconsistent LDFLAGS between -lssl '$smart_ldflags' and -lcrypto '$OPENSSL_LDFLAGS'"])
+      fi
+    fi
   else
-    OPENSSL_INCLUDE="-DOPENSSL_NO_KRB5"
+    AC_MSG_FAILURE([failed linking to libcrypto. Use --with-openssl-lib-dir=<path>, or --with-openssl=no (builds without OpenSSL)])
   fi
 
-  dnl #
-  dnl #  Now check that the header versions match the library
-  dnl #
-  AC_MSG_CHECKING([OpenSSL library and header version consistency])
-  AC_RUN_IFELSE(
-    [AC_LANG_PROGRAM(
-      [[
-        #include <stdio.h>
-        #include <openssl/opensslv.h>
-        #include <openssl/crypto.h>
-      ]],
-      [[
-        if (SSLeay() == OPENSSL_VERSION_NUMBER) {
-          return 0;
-        } else {
+  smart_try_dir="$openssl_include_dir"
+  FR_SMART_CHECK_INCLUDE(openssl/ssl.h)
+  if test "x$ac_cv_header_openssl_ssl_h" = "xyes"; then
+    AC_DEFINE(HAVE_OPENSSL_SSL_H, 1, [Define to 1 if you have the <openssl/ssl.h> header file.])
+
+    AC_CHECK_HEADERS( \
+      openssl/asn1.h \
+      openssl/conf.h \
+      openssl/crypto.h \
+      openssl/err.h \
+      openssl/evp.h \
+      openssl/hmac.h \
+      openssl/md5.h \
+      openssl/md4.h \
+      openssl/sha.h \
+      openssl/ssl.h \
+      openssl/ocsp.h \
+      openssl/engine.h,
+      [ OPENSSL_CPPFLAGS="$smart_include" ],
+      [
+        AC_MSG_FAILURE([failed locating OpenSSL headers. Use --with-openssl-include-dir=<path>, or --with-openssl=no (builds without OpenSSL)])
+      ]
+    )
+
+    AC_MSG_CHECKING([for OpenSSL version >= 0.9.7])
+    AC_EGREP_CPP(yes,
+      [#include <openssl/crypto.h>
+       #if (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+       yes
+       #endif
+      ],
+      [
+        AC_MSG_RESULT(yes)
+      ],
+      [
+        AC_MSG_RESULT(no)
+        AC_MSG_FAILURE([OpenSSL version too old])
+      ]
+    )
+
+    dnl #
+    dnl #  CPPFLAGS are passed to the compiler first, so we use
+    dnl #  them to ensure things like --sysroot don't override the
+    dnl #  library location we discovered previously.
+    dnl #
+    old_CPPFLAGS="$CPPFLAGS"
+    CPPFLAGS="$OPENSSL_CPPFLAGS $CPPFLAGS"
+
+    dnl #
+    dnl #  Now check that the header versions match the library
+    dnl #
+    AC_MSG_CHECKING([OpenSSL library and header version consistency])
+    AC_RUN_IFELSE(
+      [AC_LANG_PROGRAM(
+        [[
+          #include <stdio.h>
+          #include <openssl/opensslv.h>
+          #include <openssl/crypto.h>
+        ]],
+        [[
           printf("library: %lx header: %lx... ", (unsigned long) SSLeay(), (unsigned long) OPENSSL_VERSION_NUMBER);
-          return 1;
-        }
-      ]]
-    )],
-    [
-      AC_MSG_RESULT(yes)
-    ],
-    [
-      AC_MSG_RESULT(no)
-      AC_MSG_FAILURE([OpenSSL library version does not match header version])
-    ]
-  )
-  
-  CPPFLAGS=$old_CPPFLAGS 
-  LIBS=$old_LIBS
-  LDFLAGS="$old_LDFLAGS"
-fi
+          if (SSLeay() == OPENSSL_VERSION_NUMBER) {
+            return 0;
+          } else {
+            return 1;
+          }
+        ]]
+      )],
+      [
+        AC_MSG_RESULT(yes)
+      ],
+      [
+        AC_MSG_RESULT(no)
+        AC_MSG_FAILURE([OpenSSL library version does not match header version])
+      ],
+      [
+        AC_MSG_RESULT([cross-compiling (assuming yes)])
+      ]
+    )
+    dnl #
+    dnl #  Check if the new HMAC_CTX interface is defined
+    dnl #
+    AC_CHECK_FUNCS( \
+      SSL_get_client_random \
+      SSL_get_server_random \
+      SSL_SESSION_get_master_key \
+      HMAC_CTX_new \
+      HMAC_CTX_free \
+      ASN1_STRING_get0_data \
+      CONF_modules_load_file \
+      CRYPTO_set_id_callback \
+      CRYPTO_set_locking_callback
+    )
+    CPPFLAGS="$old_CPPFLAGS"
+  fi
 
-AC_SUBST(OPENSSL_INCLUDE)
-AC_SUBST(OPENSSL_LIBS)
-export OPENSSL_LIBS
+  LIBS="$OLD_LIBS"
+  AC_SUBST(OPENSSL_LIBS)
+  AC_SUBST(OPENSSL_LDFLAGS)
+  AC_SUBST(OPENSSL_CPPFLAGS)
+  export OPENSSL_LIBS OPENSSL_LDFLAGS OPENSSL_CPPFLAGS
+fi
 
 dnl #
 dnl #  Check the pcap includes for the RADIUS sniffer.
@@ -965,29 +1207,55 @@ dnl #
 if test "x$PCAP_LIBS" = x; then
   AC_MSG_NOTICE([skipping test for pcap.h.])
 else
-  AC_CHECK_HEADER(pcap.h,
-    [
-      AC_DEFINE(HAVE_PCAP_H, 1, [Define to 1 if you have the <pcap.h> header file.])
-      
-      AC_CHECK_LIB(pcap, pcap_fopen_offline,
-        [
-          AC_DEFINE(HAVE_PCAP_FOPEN_OFFLINE, 1, [Define to 1 if you have the function pcap_fopen_offline.])
-        ]
-      )
-      
-      AC_CHECK_LIB(pcap, pcap_dump_fopen,
-        [
-          AC_DEFINE(HAVE_PCAP_DUMP_FOPEN, 1, [Define to 1 if you have the function pcap_dump_fopen.])
-        ]
-      )
-    ],
-    [
-      PCAP_LIBS=
-      AC_MSG_WARN([pcap.h not found, silently disabling the RADIUS sniffer.])
-    ]
-  )
+  dnl #
+  dnl # Check for pcap header files
+  dnl #
+  smart_try_dir="$pcap_include_dir"
+  FR_SMART_CHECK_INCLUDE([pcap.h])
+  if test "x$ac_cv_header_pcap_h" == "xyes"; then
+    AC_DEFINE(HAVE_PCAP_H, 1, [Define to 1 if you have the <pcap.h> header file.])
+    AC_SUBST(PCAP_LIBS)
+    AC_SUBST(PCAP_LDFLAGS)
+  else
+    AC_MSG_WARN([pcap headers not found, silently disabling the RADIUS sniffer, and ARP listener. Use --with-pcap-include-dir=<path>.])
+  fi
+fi
+
+dnl Check for collectd-client
+if test "x$COLLECTDC_LIBS" = x; then
+  AC_MSG_NOTICE([skipping test for collectd/client.h.])
+else
+  dnl #
+  dnl # Check for collectd-client header files
+  dnl #
+  smart_try_dir="$collectdclient_include_dir"
+  FR_SMART_CHECK_INCLUDE([collectd/client.h])
+  if test "x$ac_cv_header_collectd_client_h" == "xyes"; then
+    AC_DEFINE(HAVE_COLLECTDC_H, 1, [Define to 1 if you have the `collectdclient' library (-lcollectdclient).])
+    AC_SUBST(COLLECTDC_LIBS)
+    AC_SUBST(COLLECTDC_LDFLAGS)
+  else
+    AC_MSG_WARN([collectdclient headers not found. Use --with-collectdclient-include-dir=<path>.])
+  fi
+fi
+
+dnl #
+dnl #  Check the CAP includes for debugger checks
+dnl #
+if test "x$HAVE_LIBCAP" = x; then
+  AC_MSG_NOTICE([skipping test for cap.h.])
+else
+  dnl #
+  dnl # Check for CAP header files
+  dnl #
+  smart_try_dir="$cap_include_dir"
+  FR_SMART_CHECK_INCLUDE([sys/capability.h])
+  if test "x$ac_cv_header_sys_capability_h" == "xyes"; then
+    AC_DEFINE(HAVE_CAPABILITY_H, 1, [Define to 1 if you have the <sys/capability.h> header file.])
+  else
+    AC_MSG_WARN([cap headers not found, will not perform debugger checks. Use --with-cap-include-dir=<path>.])
+  fi
 fi
-AC_SUBST(PCAP_LIBS)
 
 dnl #############################################################
 dnl #
@@ -1011,7 +1279,7 @@ FR_CHECK_TYPE_INCLUDE(
     #ifdef HAVE_SYS_TYPES_H
     #  include <sys/types.h>
     #endif
-    
+
     #ifdef HAVE_SYS_SOCKET_H
     #  include <sys/socket.h>
     #endif
@@ -1027,7 +1295,7 @@ FR_CHECK_TYPE_INCLUDE(
     #ifdef HAVE_INTTYPES_H
     #  include <inttypes.h>
     #endif
-  
+
     #ifdef HAVE_STDINT_H
     #  include <stdint.h>
     #endif
@@ -1067,6 +1335,42 @@ FR_CHECK_TYPE_INCLUDE(
   uint32_t, unsigned int, [uint32_t should be the canonical 'network integer']
 )
 
+dnl #
+dnl #  Check for uint64_t
+dnl #
+FR_CHECK_TYPE_INCLUDE(
+  [
+    #ifdef HAVE_INTTYPES_H
+    #  include <inttypes.h>
+    #endif
+
+    #ifdef HAVE_STDINT_H
+    #  include <stdint.h>
+    #endif
+  ],
+  uint64_t, unsigned long long, [uint64_t is required for larger counters]
+)
+
+dnl #
+dnl #  Check for __uint128_t (compiler builtin)
+dnl #
+AC_CHECK_TYPE(__uint128_t, AC_DEFINE(HAVE___UINT128_T, 1, [compiler specific 128 bit unsigned integer]), [], [])
+
+dnl #
+dnl #  Check for uint128_t (fictitious future data type)
+dnl #
+AC_CHECK_TYPE(uint128_t, AC_DEFINE(HAVE_UINT128_T, 1, [128 bit unsigned integer]), [],
+  [
+    #ifdef HAVE_INTTYPES_H
+    #  include <inttypes.h>
+    #endif
+
+    #ifdef HAVE_STDINT_H
+    #  include <stdint.h>
+    #endif
+  ]
+)
+
 AC_CHECK_TYPE(struct in6_addr, AC_DEFINE(HAVE_STRUCT_IN6_ADDR, 1, [IPv6 address structure]), [],
   [
     #ifdef HAVE_NETINET_IN_H
@@ -1109,44 +1413,83 @@ AC_CHECK_TYPE(struct addrinfo, AC_DEFINE(HAVE_STRUCT_ADDRINFO, 1, [Generic DNS l
   ]
 )
 
+dnl #
+dnl #  Check for sig_t
+dnl #
+dnl #  FR_CHECK_TYPE_INCLUDE doesn't work for callbacks as it doesn't produce typedefs
+dnl #
+AC_MSG_CHECKING([if sig_t is defined])
+AC_LINK_IFELSE(
+  [AC_LANG_PROGRAM(
+    [[
+      #ifdef HAVE_SIGNAL_H
+      #  include <signal.h>
+      #endif
+    ]],
+    [[
+      sig_t func;
+      return 0;
+    ]]
+  )],
+  [
+      AC_MSG_RESULT(yes)
+      AC_DEFINE(HAVE_SIG_T, 1, [Define if the type sig_t is defined by signal.h])
+  ],
+  [
+      AC_MSG_RESULT(no)
+  ]
+)
+
 dnl #############################################################
 dnl #
 dnl #  5. Checks for structures and functions
 dnl #
 dnl #############################################################
 AC_CHECK_FUNCS( \
-  getopt_long \
-  fcntl \
-  strsignal \
-  sigaction \
-  sigprocmask \
-  pthread_sigmask \
-  snprintf \
-  vsnprintf \
-  setsid \
-  strncasecmp \
-  strcasecmp \
-  localtime_r \
+  bindat \
+  clock_gettime \
+  closefrom \
   ctime_r \
+  dladdr \
+  fcntl \
+  fopencookie \
+  funopen \
+  getaddrinfo \
+  getnameinfo \
+  getopt_long \
+  getpeereid \
+  getresuid \
+  gettimeofday \
+  getusershell \
   gmtime_r \
-  strsep \
+  if_indextoname \
   inet_aton \
-  inet_pton \
   inet_ntop \
-  setlinebuf \
-  setvbuf \
-  getusershell \
+  inet_pton \
   initgroups \
-  getaddrinfo \
-  getnameinfo \
-  closefrom \
-  gettimeofday \
-  getpeereid \
-  setuid \
+  kqueue \
+  localtime_r \
+  mallopt \
+  mkdirat \
+  openat \
+  pthread_sigmask \
+  setlinebuf \
   setresuid \
-  getresuid \
+  setsid \
+  setuid \
+  setvbuf \
+  sigaction \
+  sigprocmask \
+  snprintf \
+  strcasecmp \
   strlcat \
-  strlcpy
+  strlcpy \
+  strncasecmp \
+  strsep \
+  strsignal \
+  unlinkat \
+  vdprintf \
+  vsnprintf
 )
 
 AC_TYPE_SIGNAL
@@ -1179,6 +1522,49 @@ if test "x$ac_cv_type_struct_in6_pktinfo_has_ipi6_addr" = "xyes"; then
   AC_DEFINE(HAVE_IN6_PKTINFO, [], [define if you have IN6_PKTINFO (Linux)])
 fi
 
+dnl #
+dnl #  Check for htonll and htonlll
+dnl #
+AC_MSG_CHECKING([if htonll is defined])
+AC_LINK_IFELSE(
+  [AC_LANG_PROGRAM(
+    [[
+      #include <sys/types.h>
+      #include <netinet/in.h>
+    ]],
+    [[
+      return htonll(0);
+    ]]
+  )],
+  [
+      AC_MSG_RESULT(yes)
+      AC_DEFINE(HAVE_HTONLL, 1, [Define if the function (or macro) htonll exists.])
+  ],
+  [
+      AC_MSG_RESULT(no)
+  ]
+)
+
+AC_MSG_CHECKING([if htonlll is defined])
+AC_LINK_IFELSE(
+  [AC_LANG_PROGRAM(
+    [[
+      #include <sys/types.h>
+      #include <netinet/in.h>
+    ]],
+    [[
+      return htonlll(0);
+    ]]
+  )],
+  [
+      AC_MSG_RESULT(yes)
+      AC_DEFINE(HAVE_HTONLLL, 1, [Define if the function (or macro) htonlll exists.])
+  ],
+  [
+      AC_MSG_RESULT(no)
+  ]
+)
+
 dnl #############################################################
 dnl #
 dnl #  6. Checks for compiler characteristics
@@ -1205,7 +1591,7 @@ AC_SUBST(LIBPREFIX)
 
 if test "x$developer" = "xyes"; then
   AC_MSG_NOTICE([Setting additional developer CFLAGS])
-  
+
   dnl #
   dnl #  Tell the compiler to parse doxygen documentation and verify it against function and variable declarations
   dnl #
@@ -1214,13 +1600,22 @@ if test "x$developer" = "xyes"; then
     devflags="-Wdocumentation"
   fi
 
-  if test "x$GCC" = "xyes"; then
-    devflags="$devflags -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -Wformat-y2k -Wno-format-extra-args -Wno-format-zero-length -Wno-cast-align -Wformat-nonliteral -Wformat-security -Wformat=2 -DWITH_VERIFY_PTR=1"
-    INSTALLSTRIP=""
+  dnl #
+  dnl #  If we have -Weverything, it really means *everything* unlike -Wall
+  dnl #  It's so verbose we need to turn off warnings which aren't useful.
+  dnl #
+  AX_CC_WEVERYTHING_FLAG
+  if test "x$ax_cv_cc_weverything_flag" = "xyes"; then
+    devflags="$devflags -W -Weverything -Wformat=2 -Wno-missing-field-initializers -Wno-date-time -Wno-padded -Wno-gnu-zero-variadic-macro-arguments -Wno-shorten-64-to-32 -Wno-sign-conversion -Wno-conversion -Wno-switch-enum -Wno-gnu-statement-expression -Wno-extended-offsetof -Wno-cast-align -Wno-documentation-unknown-command -Wno-covered-switch-default -Wno-packed -DWITH_VERIFY_PTR=1"
+  else
+    if test "x$GCC" = "xyes"; then
+      devflags="$devflags -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -Wformat-y2k -Wno-format-extra-args -Wno-format-zero-length -Wno-cast-align -Wformat-nonliteral -Wformat-security -Wformat=2 -DWITH_VERIFY_PTR=1"
+      INSTALLSTRIP=""
+    fi
   fi
-  
+
   AC_MSG_NOTICE([Developer CFLAGS are "$devflags"])
-  
+
   CFLAGS="$CFLAGS $devflags"
   dnl #
   dnl #  Enable experimental modules (we want to know if code changes breaks one of them)
@@ -1233,7 +1628,17 @@ else
   devflags=""
   CFLAGS="$CFLAGS -DNDEBUG"
   INSTALLSTRIP=""
-  AC_MSG_RESULT([no.])
+fi
+
+dnl #
+dnl #  May of been set outside of this configure script
+dnl #
+AC_MSG_CHECKING([if building with -DNDEBUG])
+if echo "$CFLAGS" | grep '\-DNDEBUG' > /dev/null; then
+  AC_MSG_RESULT([yes])
+  AC_DEFINE([WITH_NDEBUG], [1], [define if the server was built with -DNDEBUG])
+else
+  AC_MSG_RESULT([no])
 fi
 
 export EXPERIMENTAL
@@ -1243,10 +1648,17 @@ dnl #  append the current git hash onto the version string
 dnl #
 if test -d $srcdir/.git -a "x$GIT" = "xyes"; then
   RADIUSD_VERSION_COMMIT=`git log --pretty=format:'%h' -n 1`
-  AC_DEFINE_UNQUOTED([RADIUSD_VERSION_COMMIT],["${RADIUSD_VERSION_COMMIT}"],[Commit HEAD at time of configuring])
+  AC_DEFINE_UNQUOTED([RADIUSD_VERSION_COMMIT],[${RADIUSD_VERSION_COMMIT}],[Commit HEAD at time of configuring])
 fi
 
+dnl #
+dnl #  check for some compiler features
+dnl #
 FR_TLS
+FR_HAVE_BUILTIN_CHOOSE_EXPR
+FR_HAVE_BUILTIN_TYPES_COMPATIBLE_P
+FR_HAVE_BUILTIN_BSWAP64
+FR_HAVE_BOUNDED_ATTRIBUTE
 
 dnl #############################################################
 dnl #
@@ -1254,35 +1666,15 @@ dnl #  7. Checks for library functions
 dnl #
 dnl #############################################################
 
-dnl Check for talloc
-dnl extra argument: --with-talloc-include-dir=DIR
-talloc_include_dir=
-AC_ARG_WITH(talloc-include-dir,
-  [AS_HELP_STRING([--with-talloc-include-dir=DIR],
-  [Directory where the talloc includes may be found])],
-  [case "$withval" in
-    no)
-      AC_MSG_ERROR([Need talloc-include-dir])
-      ;;
-    yes)
-      ;;
-    *)
-      talloc_include_dir="$withval"
-      ;;
-  esac])
-
 dnl #
-dnl # Check for talloc header files
+dnl # Check for talloc_set_memlimit
+dnl # This was only included in version 2.0.8
 dnl #
-smart_try_dir="$talloc_include_dir"
-FR_SMART_CHECK_INCLUDE([talloc.h])
-if test "x$ac_cv_header_talloc_h" != "xyes"; then
-  AC_MSG_WARN([talloc headers not found. Use --with-talloc-include-dir=<path>.])
-  AC_MSG_ERROR([FreeRADIUS requires libtalloc])
-else
-  INCLUDE="${SMART_CFLAGS} ${INCLUDE}"
-  LIBS="-ltalloc ${LIBS}"
-fi
+AC_CHECK_LIB(talloc, talloc_set_memlimit,
+  [
+    AC_DEFINE(HAVE_TALLOC_SET_MEMLIMIT, 1, [Define to 1 if you have the function talloc_set_memlimit.])
+  ]
+)
 
 dnl #
 dnl # Check for libcrypt
@@ -1305,6 +1697,212 @@ AC_CHECK_LIB(cipher, setkey,
 AC_SUBST(CRYPTLIB)
 
 dnl #
+dnl #  Check for libexecinfo support, on some systems this is built into libc
+dnl #  on others it's a separate library.
+dnl #
+dnl extra argument: --with-execinfo-lib-dir
+execinfo_lib_dir=
+AC_ARG_WITH(execinfo-lib-dir,
+[AS_HELP_STRING([--with-execinfo-lib-dir=DIR],
+[directory in which to look for execinfo library files])],
+[ case "$withval" in
+    no)
+        AC_MSG_ERROR([Need execinfo-lib-dir])
+       ;;
+    yes)
+       ;;
+    *)
+       execinfo_lib_dir="$withval"
+       ;;
+  esac ]
+)
+
+dnl extra argument: --with-execinfo-include-dir
+execinfo_include_dir=
+AC_ARG_WITH(execinfo-include-dir,
+[AS_HELP_STRING([--with-execinfo-include-dir=DIR],
+[directory in which to look for execinfo include files])],
+[ case "$withval" in
+    no)
+        AC_MSG_ERROR([Need execinfo-include-dir])
+       ;;
+    yes)
+       ;;
+    *)
+       execinfo_include_dir="$withval"
+       ;;
+  esac ]
+)
+
+dnl #
+dnl #  Look for execinfo.h and symbols
+dnl #
+smart_try_dir=$execinfo_include_dir
+FR_SMART_CHECK_INCLUDE(execinfo.h)
+if test "x$ac_cv_header_execinfo_h" = "xyes"; then
+  smart_try_dir=$execinfo_lib_dir
+  FR_SMART_CHECK_LIB(execinfo, backtrace_symbols)
+  if test "x$ac_cv_lib_execinfo_backtrace_symbols" != "xyes"; then
+    dnl # Might be provided as part of libc
+    AC_MSG_CHECKING([if execinfo provided as part of libc])
+    AC_TRY_LINK(
+      [
+        #include <execinfo.h>
+      ],
+      [
+        void *sym[1];
+        backtrace_symbols(&sym, sizeof(sym)) ],
+      [
+        AC_MSG_RESULT(yes)
+        ac_cv_lib_execinfo_backtrace_symbols="yes"
+      ],
+      [
+        AC_MSG_RESULT(no)
+      ]
+    )
+  fi
+
+  if test "x$ac_cv_lib_execinfo_backtrace_symbols" = "xyes"; then
+    AC_DEFINE(HAVE_EXECINFO, [1], [define this if we have <execinfo.h> and symbols])
+  fi
+fi
+
+dnl #
+dnl #  Check for regular expression support.
+dnl #
+dnl extra argument: --with-pcre
+PCRE=yes
+AC_ARG_WITH(pcre,
+[AS_HELP_STRING([--with-pcre],
+[use libpcre (if available). (default=yes)])],
+[ case "$withval" in
+    no)
+    PCRE=no
+       ;;
+    yes)
+    PCRE=yes
+       ;;
+  esac ]
+)
+
+dnl extra argument: --with-pcre-lib-dir
+pcre_lib_dir=
+AC_ARG_WITH(pcre-lib-dir,
+[AS_HELP_STRING([--with-pcre-lib-dir=DIR],
+[directory in which to look for pcre library files])],
+[ case "$withval" in
+    no)
+       AC_MSG_ERROR(Need pcre-lib-dir)
+       ;;
+    yes)
+       ;;
+    *)
+       pcre_lib_dir="$withval"
+       ;;
+  esac ]
+)
+
+dnl extra argument: --with-pcre-include-dir
+pcre_include_dir=
+AC_ARG_WITH(pcre-include-dir,
+[AS_HELP_STRING([--with-pcre-include-dir=DIR],
+[directory in which to look for pcre include files])],
+[ case "$withval" in
+    no)
+       AC_MSG_ERROR(Need pcre-include-dir)
+       ;;
+    yes)
+       ;;
+    *)
+       pcre_include_dir="$withval"
+       ;;
+  esac ]
+)
+
+dnl extra argument: --with-regex
+REGEX=
+AC_ARG_WITH(regex,
+[AS_HELP_STRING([--with-regex],
+[Whether to build with regular expressions (default=yes)])],
+[ case "$withval" in
+    no)
+       REGEX=no
+       ;;
+    *)
+       ;;
+  esac ]
+)
+
+dnl #
+dnl #  First look for PCRE
+dnl #
+if test "x$REGEX" != "xno" && test "x$PCRE" != "xno"; then
+  smart_try_dir=$pcre_include_dir
+  FR_SMART_CHECK_INCLUDE(pcre.h)
+  if test "x$ac_cv_header_pcre_h" = "xyes"; then
+    smart_try_dir=$pcre_lib_dir
+    FR_SMART_CHECK_LIB(pcre, pcre_compile)
+    if test "x$ac_cv_lib_pcre_pcre_compile" = "xyes"; then
+      REGEX=yes
+      AC_DEFINE(HAVE_PCRE, [1], [define this if we have libpcre])
+      AC_DEFINE(HAVE_BINSAFE_REGEX, 1, [Define if we have a binary safe regular expression library])
+    fi
+  fi
+fi
+
+dnl #
+dnl #  If no PCRE, fallback to POSIX regular expressions
+dnl #
+if test "x$REGEX" = "x"; then
+  smart_try_dir=
+  FR_SMART_CHECK_INCLUDE(regex.h)
+  if test "x$ac_cv_header_regex_h" = "xyes"; then
+    REGEX=yes
+    AC_MSG_CHECKING([for extended regular expressions])
+    AC_EGREP_CPP(yes,
+      [
+        #include <regex.h>
+        #ifdef REG_EXTENDED
+        yes
+        #endif
+      ],
+      [
+        AC_MSG_RESULT(yes)
+        AC_DEFINE(HAVE_REG_EXTENDED, [1], [define this if we have REG_EXTENDED (from <regex.h>)])
+      ],
+      [
+        AC_MSG_RESULT(no)
+      ]
+    )
+
+    dnl #
+    dnl #  Some platforms require the regex library to be linked explicitly
+    dnl #
+    AC_CHECK_LIB(regex, regcomp,
+      [
+        LIBS="-lregex $LIBS"
+      ]
+    )
+
+    dnl #
+    dnl #  Check for some BSD extensions which allow normal regexes to be
+    dnl #  binary safe.
+    dnl #
+    AC_CHECK_FUNCS(\
+      regncomp \
+      regnexec
+    )
+    if test x"$ac_cv_func_regncomp" = x"yes" && test  x"$ac_cv_func_regnexec" = x"yes"; then
+      AC_DEFINE(HAVE_BINSAFE_REGEX, 1, [Define if we have a binary safe regular expression library])
+    fi
+  fi
+fi
+
+if test "x$REGEX" = "xyes"; then
+  AC_DEFINE(HAVE_REGEX, 1, [Define if we have any regular expression library])
+fi
+
+dnl #
 dnl #  Check the style of gethostbyaddr, in order of preference
 dnl #  GNU (_r eight args)
 dnl #
@@ -1341,7 +1939,7 @@ case "$host" in
           [style of gethostbyaddr_r functions ])
         gethostbyaddrrstyle=BSD
         AC_MSG_WARN([FreeBSD overridden to BSD-style])
-      ], 
+      ],
       [
         #ifdef HAVE_NETDB_H
         #include <netdb.h>
@@ -1465,6 +2063,52 @@ if test "x$gethostbynamerstyle" = "xBSD"; then
 fi
 
 dnl #
+dnl #  Check for thread-safe getpwnam_r and getgrnam_r
+dnl #
+if test "x$ac_cv_header_pwd_h" = "xyes"; then
+  AC_MSG_CHECKING([getpwnam_r])
+  AC_TRY_LINK(
+    [
+      #include <stdlib.h>
+      #include <sys/types.h>
+      #include <pwd.h>
+    ],
+    [ getpwnam_r(NULL, NULL, NULL, 0, NULL) ],
+    [
+      AC_MSG_RESULT([yes])
+      AC_DEFINE(HAVE_GETPWNAM_R, 1,
+                [Define to 1 if you have the getpwnam_r.]
+                )
+    ],
+    [
+        AC_MSG_RESULT(no)
+    ]
+  )
+fi
+
+if test "x$ac_cv_header_grp_h" = "xyes"; then
+  AC_MSG_CHECKING([getgrnam_r])
+  AC_TRY_LINK(
+    [
+      #include <stdlib.h>
+      #include <sys/types.h>
+      #include <grp.h>
+    ],
+    [ getgrnam_r(NULL, NULL, NULL, 0, NULL) ],
+    [
+      AC_MSG_RESULT([yes])
+      AC_DEFINE(HAVE_GETGRNAM_R, 1,
+                [Define to 1 if you have the getgrnam_r.]
+                )
+    ],
+    [
+        AC_MSG_RESULT(no)
+    ]
+  )
+fi
+
+
+dnl #
 dnl #  Check for non-posix solaris ctime_r (extra buflen int arg)
 dnl #
 AC_DEFINE(POSIXSTYLE, [1], [Posix-Style ctime_r])
@@ -1574,7 +2218,7 @@ dnl #
 dnl #############################################################
 if test "x$werror" == "xyes"; then
   CFLAGS="-Werror $CFLAGS"
-fi  
+fi
 
 dnl #############################################################
 dnl #
@@ -1584,7 +2228,7 @@ dnl #############################################################
 AC_CONFIG_COMMANDS([stamp-h], [echo timestamp > src/include/stamp-h])
 AC_CONFIG_COMMANDS([build-radpaths-h], [(cd ./src/include && /bin/sh ./build-radpaths-h)])
 AC_CONFIG_COMMANDS([main-chmod], [(cd ./src/main && chmod +x checkrad radlast radtest)])
-AC_CONFIG_COMMANDS([scripts-chmod], [(cd ./scripts && chmod +x rc.radiusd radiusd.cron.daily radiusd.cron.monthly cryptpasswd)])
+AC_CONFIG_COMMANDS([scripts-chmod], [(cd ./scripts && chmod +x rc.radiusd cron/radiusd.cron.daily cron/radiusd.cron.monthly cryptpasswd)])
 
 dnl #
 dnl #  Substitute whatever libraries we found to be necessary
@@ -1592,9 +2236,8 @@ dnl #
 AC_SUBST(LIBS)
 AC_SUBST(INSTALLSTRIP)
 
-USE_SHARED_LIBS=$enable_shared
 AC_SUBST(USE_SHARED_LIBS)
-USE_STATIC_LIBS=$enable_static
+USE_STATIC_LIBS="yes"
 AC_SUBST(USE_STATIC_LIBS)
 AC_SUBST(STATIC_MODULES)
 
@@ -1606,10 +2249,9 @@ AC_OUTPUT(\
   ./src/main/radlast \
   ./src/main/radtest \
   ./scripts/rc.radiusd \
-  ./scripts/radiusd.cron.daily \
-  ./scripts/radiusd.cron.monthly \
+  ./scripts/cron/radiusd.cron.daily \
+  ./scripts/cron/radiusd.cron.monthly \
   ./scripts/cryptpasswd \
-  ./raddb/dictionary \
   ./raddb/radrelay.conf \
   ./raddb/radiusd.conf
 )