# include <gnutls/gnutls.h>
# include <gnutls/x509.h>
# if GNUTLS_VERSION_NUMBER >= 0x030103
-# define HAVE_OCSP
+# define HAVE_GNUTLS_OCSP
# include <gnutls/ocsp.h>
# endif
# ifndef GNUTLS_NO_EXTENSIONS
/*BIO_printf(arg, "OCSP response: ");*/
if (!p)
{
- BIO_printf(arg, "no response received\n");
+ BIO_printf(arg, "no OCSP response received\n");
return 1;
}
if(!(rsp = d2i_OCSP_RESPONSE(NULL, &p, len)))
{
- BIO_printf(arg, "response parse error\n");
+ BIO_printf(arg, "OCSP response parse error\n");
BIO_dump_indent(arg, (char *)p, len, 4);
return 0;
}
if(!(bs = OCSP_response_get1_basic(rsp)))
{
- BIO_printf(arg, "error parsing response\n");
+ BIO_printf(arg, "error parsing OCSP response\n");
return 0;
}
if(OCSP_basic_verify(bs, sk, NULL, OCSP_NOVERIFY) <= 0)
{
- BIO_printf(arg, "Response Verify Failure\n");
+ BIO_printf(arg, "OCSP status response verify failure\n");
ERR_print_errors(arg);
ret = 0;
}
else
- BIO_printf(arg, "Response verify OK\n");
+ BIO_printf(arg, "OCSP status response: good signature\n");
cert_stack_free(sk);
return ret;
if (*inptr != 0)
goto nextinput;
- #ifdef HAVE_TLS
+#ifdef HAVE_TLS
if (srv->sent_starttls)
{
if (lineptr[0] == '2')
printf("Attempting to start TLS\n");
fflush(stdout);
- #ifdef HAVE_OPENSSL
+# ifdef HAVE_OPENSSL
srv->tls_active = tls_start(srv->sock, &srv->ssl, srv->ctx);
- #endif
+# endif
- #ifdef HAVE_GNUTLS
+# ifdef HAVE_GNUTLS
{
int rc;
fd_set rfd;
DEBUG { printf("gnutls_record_recv: %d\n", rc); fflush(stdout); }
}
}
- #endif
+# endif /*HAVE_GNUTLS*/
if (!srv->tls_active)
{
printf("Failed to start TLS\n");
fflush(stdout);
}
- #ifdef HAVE_GNUTLS
+
+# ifdef HAVE_OPENSSL
+ else if (ocsp_stapling)
+ printf("Succeeded in starting TLS (with OCSP)\n");
+# endif
+
+# ifdef HAVE_GNUTLS
else if (ocsp_stapling)
{
if ((rc= gnutls_certificate_verify_peers2(tls_session, &verify)) < 0)
printf("Bad certificate\n");
fflush(stdout);
}
- #ifdef HAVE_OCSP
+# ifdef HAVE_GNUTLS_OCSP
else if (gnutls_ocsp_status_request_is_checked(tls_session, 0) == 0)
{
printf("Failed to verify certificate status\n");
fflush(stdout);
}
else
+ {
+ printf("OCSP status response: good signature\n");
printf("Succeeded in starting TLS (with OCSP)\n");
- #endif
+ }
+# endif /*HAVE_GNUTLS_OCSP*/
}
- #endif
+# endif /*HAVE_GNUTLS*/
+
else
printf("Succeeded in starting TLS\n");
}
- else printf("Abandoning TLS start attempt\n");
+ else
+ printf("Abandoning TLS start attempt\n");
}
srv->sent_starttls = 0;
#endif
if (keyfile != NULL) printf("Key file = %s\n", keyfile);
tls_init(US certfile, US keyfile);
tls_session = tls_session_init();
-#ifdef HAVE_OCSP
+#ifdef HAVE_GNUTLS_OCSP
if (ocsp_stapling)
gnutls_ocsp_status_request_enable_client(tls_session, NULL, 0, NULL);
#endif
if (!srv.tls_active)
printf("Failed to start TLS\n");
-#if defined(HAVE_GNUTLS) && defined(HAVE_OCSP)
+#if defined(HAVE_GNUTLS) && defined(HAVE_GNUTLS_OCSP)
else if ( ocsp_stapling
&& gnutls_ocsp_status_request_is_checked(tls_session, 0) == 0)
printf("Failed to verify certificate status\n");