#if GNUTLS_VERSION_NUMBER >= 0x020c00
# include <gnutls/pkcs11.h>
#endif
-#ifdef EXPERIMENTAL_OCSP
+#if GNUTLS_VERSION_NUMBER < 0x030103 && !defined(DISABLE_OCSP)
+# warning "GnuTLS library version too old; define DISABLE_OCSP in Makefile"
+# define DISABLE_OCSP
+#endif
+
+#ifndef DISABLE_OCSP
# include <gnutls/ocsp.h>
#endif
uschar *exp_tls_certificate;
uschar *exp_tls_privatekey;
- uschar *exp_tls_sni;
uschar *exp_tls_verify_certificates;
uschar *exp_tls_crl;
uschar *exp_tls_require_ciphers;
static int exim_sni_handling_cb(gnutls_session_t session);
-#ifdef EXPERIMENTAL_OCSP
+#ifndef DISABLE_OCSP
static int server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
gnutls_datum_t * ocsp_response);
#endif
/* Set the OCSP stapling server info */
-#ifdef EXPERIMENTAL_OCSP
+#ifndef DISABLE_OCSP
if ( !host /* server */
&& tls_ocsp_file
)
/* set SNI in client, only */
if (host)
{
- if (!expand_check(state->tlsp->sni, US"tls_out_sni", &state->exp_tls_sni))
+ if (!expand_check(sni, US"tls_out_sni", &state->tlsp->sni))
return DEFER;
- if (state->exp_tls_sni && *state->exp_tls_sni)
+ if (state->tlsp->sni && *state->tlsp->sni)
{
DEBUG(D_tls)
- debug_printf("Setting TLS client SNI to \"%s\"\n", state->exp_tls_sni);
- sz = Ustrlen(state->exp_tls_sni);
+ debug_printf("Setting TLS client SNI to \"%s\"\n", state->tlsp->sni);
+ sz = Ustrlen(state->tlsp->sni);
rc = gnutls_server_name_set(state->session,
- GNUTLS_NAME_DNS, state->exp_tls_sni, sz);
+ GNUTLS_NAME_DNS, state->tlsp->sni, sz);
exim_gnutls_err_check(US"gnutls_server_name_set");
}
}
-#ifdef EXPERIMENTAL_OCSP
+#ifndef DISABLE_OCSP
static int
server_ocsp_stapling_cb(gnutls_session_t session, void * ptr,
int rc;
const char *error;
exim_gnutls_state_st *state = NULL;
-#ifdef EXPERIMENTAL_OCSP
+#ifndef DISABLE_OCSP
BOOL require_ocsp = verify_check_this_host(&ob->hosts_require_ocsp,
NULL, host->name, host->address, NULL) == OK;
BOOL request_ocsp = require_ocsp ? TRUE
gnutls_certificate_server_set_request(state->session, GNUTLS_CERT_IGNORE);
}
-#ifdef EXPERIMENTAL_OCSP /* since GnuTLS 3.1.3 */
+#ifndef DISABLE_OCSP
+ /* supported since GnuTLS 3.1.3 */
if (request_ocsp)
{
DEBUG(D_tls) debug_printf("TLS: will request OCSP stapling\n");
!verify_certificate(state, &error))
return tls_error(US"certificate verification failed", error, state->host);
-#ifdef EXPERIMENTAL_OCSP
+#ifndef DISABLE_OCSP
if (require_ocsp)
{
DEBUG(D_tls)