From: Todd Lyons <tlyons@exim.org>
Date: Wed, 29 Oct 2014 14:26:17 +0000 (-0700)
Subject: Test suite: disable OCSP for old OpenSSL versions
X-Git-Tag: exim-4_85_RC1~20
X-Git-Url: https://git.exim.org/exim.git/commitdiff_plain/6d68e1c72d8bd58b005e9d1c8df890e4fe5e6536

Test suite: disable OCSP for old OpenSSL versions

OpenSSL 0.9.8 in CentOS 5.x has early OCSP support, but not stapling
  so just completely disable OCSP using the same logic that exists
  in tls-openssl.c.
---

diff --git a/test/src/client.c b/test/src/client.c
index 50897a155..72cebbeb4 100644
--- a/test/src/client.c
+++ b/test/src/client.c
@@ -58,6 +58,10 @@ static int sigalrm_seen = 0;
 
 /* TLS support can be optionally included, either for OpenSSL or GnuTLS. The
 latter needs a whole pile of tables. */
+#if !defined(EXIM_HAVE_OPENSSL_TLSEXT) && !defined(DISABLE_OCSP)
+# warning "OpenSSL library version too old; define DISABLE_OCSP in Makefile"
+# define DISABLE_OCSP
+#endif
 
 #ifdef HAVE_OPENSSL
 # define HAVE_TLS
@@ -67,7 +71,9 @@ latter needs a whole pile of tables. */
 # include <openssl/ssl.h>
 # include <openssl/err.h>
 # include <openssl/rand.h>
-# include <openssl/ocsp.h>
+# ifndef DISABLE_OCSP
+#  include <openssl/ocsp.h>
+# endif
 #endif
 
 
@@ -188,6 +194,7 @@ setup_verify(BIO *bp, char *CAfile, char *CApath)
 }
 
 
+#ifndef DISABLE_OCSP
 static int
 tls_client_stapling_cb(SSL *s, void *arg)
 {
@@ -238,6 +245,7 @@ else
 X509_STORE_free(store);
 return ret;
 }
+#endif
 
 
 /*************************************************
@@ -257,12 +265,14 @@ SSL_set_session_id_context(*ssl, sid_ctx, strlen(sid_ctx));
 SSL_set_fd (*ssl, sock);
 SSL_set_connect_state(*ssl);
 
+#ifndef DISABLE_OCSP
 if (ocsp_stapling)
   {
   SSL_CTX_set_tlsext_status_cb(ctx, tls_client_stapling_cb);
   SSL_CTX_set_tlsext_status_arg(ctx, BIO_new_fp(stdout, BIO_NOCLOSE));
   SSL_set_tlsext_status_type(*ssl, TLSEXT_STATUSTYPE_ocsp);
   }
+#endif
 
 signal(SIGALRM, sigalrm_handler_flag);
 sigalrm_seen = 0;