I'm trying to build openssh-7.3 like this:

$ ./configure --with-ldns
$ make
â¦
(cd openbsd-compat && make)
make[1]: Entering directory '/hdhome/oskar/Downloads/openssh-7.3p1/openbsd-compat'
gcc -g -O2 -Wall -Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security -Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result -fno-strict-aliasing -ftrapv -fno-builtin-memset -fstack-protector-strong -fPIE  -I. -I.. -I. -I./..  -DHAVE_CONFIG_H -c getrrsetbyname-ldns.c
In file included from ../openbsd-compat/openbsd-compat.h:173:0,
                 from ../includes.h:171,
                 from getrrsetbyname-ldns.c:46:
../openbsd-compat/bsd-misc.h:139:39: error: expected identifier or '(' before 'do'
 # define krb5_free_error_message(a,b) do { } while(0)
                                       ^
../openbsd-compat/bsd-misc.h:139:46: error: expected identifier or '(' before 'while'
 # define krb5_free_error_message(a,b) do { } while(0)
                                              ^
Makefile:26: recipe for target 'getrrsetbyname-ldns.o' failed

The reason seem to be that ldns itself is compiled with kerberos support and when including the <ldns/ldns.h>, the prototype of real function krb5_free_error_message() is broken by the previous macro definition in openbsd-compat/bsd-misc.h.

I've found out that this can be worked around by reordering the includes in openbsd-compat/getrrsetbyname-ldns.c so the <ldns/ldns.h> is included before the "includes.h". Other workaround is to compile openssh with kerberos support or without ldns support, obviously.