Add ocsp_require_stapling config option for tls - allows a connection

to indicate that it requires the peer to provide a stapled OCSP response
with the handshake.  Provide a "-T muststaple" for nc that uses it.
ok jsing@, guenther@

1 files changed, 2 insertions, 1 deletions

diff --git a/src/lib/libtls/tls_internal.h b/src/lib/libtls/tls_internal.h
index fde4066f7c..0112ceedb9 100644
--- a/src/lib/libtls/tls_internal.h
+++ b/src/lib/libtls/tls_internal.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_internal.h,v 1.45 2016/11/03 10:05:32 jsing Exp $ */
+/* $OpenBSD: tls_internal.h,v 1.46 2016/11/04 05:13:13 beck Exp $ */
 /*
  * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org>
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
@@ -64,6 +64,7 @@ struct tls_config {
         int dheparams;
         int ecdhecurve;
         struct tls_keypair *keypair;
+        int ocsp_require_stapling;
         uint32_t protocols;
         int verify_cert;
         int verify_client;