1 files changed, 10 insertions, 2 deletions

diff --git a/src/usr.bin/nc/netcat.c b/src/usr.bin/nc/netcat.c
index b71c0426dc..4a841fb96d 100644
--- a/src/usr.bin/nc/netcat.c
+++ b/src/usr.bin/nc/netcat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: netcat.c,v 1.167 2016/11/04 05:13:13 beck Exp $ */
+/* $OpenBSD: netcat.c,v 1.168 2016/11/05 15:13:26 beck Exp $ */
 /*
  * Copyright (c) 2001 Eric Jackson <ericj@monkey.org>
  * Copyright (c) 2015 Bob Beck.  All rights reserved.
@@ -100,6 +100,7 @@ int	rtableid = -1;
 int     usetls;                                 /* use TLS */
 char    *Cflag;                                 /* Public cert file */
 char    *Kflag;                                 /* Private key file */
+char    *oflag;                                 /* OCSP stapling file */
 char    *Rflag = DEFAULT_CA_FILE;               /* Root CA file */
 int     tls_cachanged;                          /* Using non-default CA file */
 int     TLSopt;                                 /* TLS options */
@@ -163,7 +164,7 @@ main(int argc, char *argv[])
         signal(SIGPIPE, SIG_IGN);
 
         while ((ch = getopt(argc, argv,
-            "46C:cDde:FH:hI:i:K:klM:m:NnO:P:p:R:rSs:T:tUuV:vw:X:x:z")) != -1) {
+            "46C:cDde:FH:hI:i:K:klM:m:NnO:o:P:p:R:rSs:T:tUuV:vw:X:x:z")) != -1) {
                 switch (ch) {
                 case '4':
                         family = AF_INET;
@@ -295,6 +296,9 @@ main(int argc, char *argv[])
                                 errx(1, "TCP send window %s: %s",
                                     errstr, optarg);
                         break;
+                case 'o':
+                        oflag = optarg;
+                        break;
                 case 'S':
                         Sflag = 1;
                         break;
@@ -380,6 +384,8 @@ main(int argc, char *argv[])
                 errx(1, "you must specify -c to use -C");
         if (Kflag && !usetls)
                 errx(1, "you must specify -c to use -K");
+        if (oflag && !Cflag)
+                errx(1, "you must specify -C to use -o");
         if (tls_cachanged && !usetls)
                 errx(1, "you must specify -c to use -R");
         if (tls_expecthash && !usetls)
@@ -455,6 +461,8 @@ main(int argc, char *argv[])
                         errx(1, "%s", tls_config_error(tls_cfg));
                 if (Kflag && tls_config_set_key_file(tls_cfg, Kflag) == -1)
                         errx(1, "%s", tls_config_error(tls_cfg));
+                if (oflag && tls_config_set_ocsp_staple_file(tls_cfg, oflag) == -1)
+                        errx(1, "%s", tls_config_error(tls_cfg));
                 if (TLSopt & TLS_LEGACY) {
                         tls_config_set_protocols(tls_cfg, TLS_PROTOCOLS_ALL);
                         tls_config_set_ciphers(tls_cfg, "all");