Add ocsp_require_stapling config option for tls - allows a connection

to indicate that it requires the peer to provide a stapled OCSP response
with the handshake.  Provide a "-T muststaple" for nc that uses it.
ok jsing@, guenther@

1 files changed, 6 insertions, 1 deletions

diff --git a/src/lib/libtls/tls_ocsp.c b/src/lib/libtls/tls_ocsp.c
index aa085bd245..af65771f7c 100644
--- a/src/lib/libtls/tls_ocsp.c
+++ b/src/lib/libtls/tls_ocsp.c
@@ -304,8 +304,13 @@ tls_ocsp_verify_cb(SSL *ssl, void *arg)
                 return -1;
 
         size = SSL_get_tlsext_status_ocsp_resp(ssl, &raw);
-        if (size <= 0)
+        if (size <= 0) {
+                if (ctx->config->ocsp_require_stapling) {
+                        tls_set_errorx(ctx, "no stapled OCSP response provided");
+                        return 0;
+                }
                 return 1;
+        }
 
         tls_ocsp_ctx_free(ctx->ocsp_ctx);
         ctx->ocsp_ctx = tls_ocsp_setup_from_peer(ctx);