serv: support building with OCSP disabled

Support gnutls-serv when building GnuTLS with OCSP API disabled.

Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>

diff --git a/src/Makefile.am b/src/Makefile.am
index 92762fa88a5506643c5ea4d75fb82859ba3b3395..2677fbd221a73296d0b6f1d6bf0c800fc0b399ef 100644 (file)
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -82,13 +82,13 @@ else
 LIBOPTS = $(LIBOPTS_LDADD)
 endif
 
-bin_PROGRAMS = psktool gnutls-cli-debug certtool
+bin_PROGRAMS = psktool gnutls-cli-debug certtool gnutls-serv
 if ENABLE_SRP
 bin_PROGRAMS += srptool
 endif
 
 if ENABLE_OCSP
-bin_PROGRAMS += ocsptool gnutls-serv 
+bin_PROGRAMS += ocsptool
 if ENABLE_ANON
 bin_PROGRAMS += gnutls-cli
 endif
@@ -140,6 +140,8 @@ noinst_LTLIBRARIES += libcmd-ocsp.la
 libcmd_ocsp_la_SOURCES = ocsptool-args.def
 nodist_libcmd_ocsp_la_SOURCES = ocsptool-args.h ocsptool-args.c
 
+endif
+
 gnutls_serv_SOURCES =          \
   list.h serv.c                        \
   udp-serv.c udp-serv.h                \
@@ -153,6 +155,7 @@ noinst_LTLIBRARIES += libcmd-serv.la
 libcmd_serv_la_SOURCES = serv-args.def
 nodist_libcmd_serv_la_SOURCES = serv-args.c serv-args.h
 
+if ENABLE_OCSP
 if ENABLE_ANON
 
 BENCHMARK_SRCS = benchmark-cipher.c benchmark.c benchmark.h benchmark-tls.c

diff --git a/src/serv.c b/src/serv.c
index de5691261f622300c3917e425366e71047f7dd57..a4dd445da801bd33ae5cc4c5a36876a152293142 100644 (file)
--- a/src/serv.c
+++ b/src/serv.c
@@ -121,7 +121,9 @@ static void tcp_server(const char *name, int port);
 /* These are global */
 gnutls_srp_server_credentials_t srp_cred = NULL;
 gnutls_psk_server_credentials_t psk_cred = NULL;
+#ifdef ENABLE_ANON
 gnutls_anon_server_credentials_t dh_cred = NULL;
+#endif
 gnutls_certificate_credentials_t cert_cred = NULL;
 
 const int ssl_session_cache = 2048;
@@ -384,7 +386,9 @@ gnutls_session_t initialize_session(int dtls)
        int ret;
        unsigned i;
        const char *err;
+#ifdef ENABLE_ALPN
        gnutls_datum_t alpn[MAX_ALPN_PROTOCOLS];
+#endif
        unsigned alpn_size;
        unsigned flags = GNUTLS_SERVER | GNUTLS_POST_HANDSHAKE_AUTH | GNUTLS_ENABLE_RAWPK;
 
@@ -443,6 +447,12 @@ gnutls_session_t initialize_session(int dtls)
                }
        }
 
+#ifndef ENABLE_ALPN
+       if (alpn_protos_size != 0) {
+               fprintf(stderr, "ALPN is not supported\n");
+               exit(1);
+       }
+#else
        alpn_size = MIN(MAX_ALPN_PROTOCOLS,alpn_protos_size);
        for (i=0;i<alpn_size;i++) {
                alpn[i].data = (void*)alpn_protos[i];
@@ -454,8 +464,11 @@ gnutls_session_t initialize_session(int dtls)
                fprintf(stderr, "Error setting ALPN protocols: %s\n", gnutls_strerror(ret));
                exit(1);
        }
+#endif
 
+#ifdef ENABLE_ANON
        gnutls_credentials_set(session, GNUTLS_CRD_ANON, dh_cred);
+#endif
 
        if (srp_cred != NULL)
                gnutls_credentials_set(session, GNUTLS_CRD_SRP, srp_cred);
@@ -705,11 +718,13 @@ static char *peer_print_info(gnutls_session_t session, int *ret_length,
                }
 #endif
 
+#if defined(ENABLE_DHE) || defined(ENABLE_ANON)
                if (kx_alg == GNUTLS_KX_DHE_RSA || kx_alg == GNUTLS_KX_DHE_DSS) {
                        snprintf(tmp_buffer, tmp_buffer_size,
                                 "Ephemeral DH using prime of <b>%d</b> bits.<br>\n",
                                 gnutls_dh_get_prime_bits(session));
                }
+#endif
 
                tmp = gnutls_compression_get_name(gnutls_compression_get(session));
                if (tmp == NULL)
@@ -1256,6 +1271,12 @@ int main(int argc, char **argv)
                        "Warning: no private key and certificate pairs were set.\n");
        }
 
+#ifndef ENABLE_OCSP
+       if (HAVE_OPT(IGNORE_OCSP_RESPONSE_ERRORS) || ocsp_responses_size != 0) {
+               fprintf(stderr, "OCSP is not supported!\n");
+                       exit(1);
+       }
+#else
        /* OCSP status-request TLS extension */
        if (HAVE_OPT(IGNORE_OCSP_RESPONSE_ERRORS))
                gnutls_certificate_set_flags(cert_cred, GNUTLS_CERTIFICATE_SKIP_OCSP_RESPONSE_CHECK);
@@ -1271,13 +1292,19 @@ int main(int argc, char **argv)
                        exit(1);
                }
        }
+#endif
 
        if (use_static_dh_params) {
+#if defined(ENABLE_DHE) || defined(ENABLE_ANON)
                ret = gnutls_certificate_set_known_dh_params(cert_cred, GNUTLS_SEC_PARAM_MEDIUM);
                if (ret < 0) {
                        fprintf(stderr, "Error while setting DH parameters: %s\n", gnutls_strerror(ret));
                        exit(1);
                }
+#else
+               fprintf(stderr, "Setting DH parameters is not supported\n");
+               exit(1);
+#endif
        } else {
                gnutls_certificate_set_params_function(cert_cred, get_params);
        }