Settings to verify OCSP stapling response (if received any) for client connections

NetSSL_OpenSSL/include/Poco/Net/Context.h

@@ -155,7 +155,11 @@ class NetSSL_API Context: public Poco::RefCountedObject
 		bool loadDefaultCAs;
 			/// Specifies whether the builtin CA certificates from OpenSSL are used.
 			/// Defaults to false.
-
+
+		bool ocspStaplingVerification;
+			/// Specifies whether Client should verify OCSP Response
+			/// Defaults to false.
+
 		std::string cipherList;
 			/// Specifies the supported ciphers in OpenSSL notation.
 			/// Defaults to "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH".
@@ -371,7 +375,11 @@ class NetSSL_API Context: public Poco::RefCountedObject
 		/// When choosing a cipher, use the server's preferences instead of the client
 		/// preferences. When not called, the SSL server will always follow the clients
 		/// preferences. When called, the SSL/TLS server will choose following its own
-		/// preferences.
+		/// preferences.	
+
+	bool ocspStaplingResponseVerificationEnabled() const;
+		/// Returns true if automatic OCSP response
+		/// reception and verification is enabled for client connections
 
 private:
 	void init(const Params& params);
@@ -391,6 +399,7 @@ class NetSSL_API Context: public Poco::RefCountedObject
 	VerificationMode _mode;
 	SSL_CTX* _pSSLContext;
 	bool _extendedCertificateVerification;
+	bool _ocspStaplingResponseVerification;
 };
 
 
@@ -429,6 +438,10 @@ inline bool Context::extendedCertificateVerificationEnabled() const
 	return _extendedCertificateVerification;
 }
 
+inline bool Context::ocspStaplingResponseVerificationEnabled() const
+{
+	return _ocspStaplingResponseVerification;
+}
 
 } } // namespace Poco::Net
 

NetSSL_OpenSSL/include/Poco/Net/SSLManager.h

@@ -278,6 +278,11 @@ class NetSSL_API SSLManager
 		/// Throws a InvalidStateException if not application instance
 		/// is available.
 
+	static int verifyOCSPResponse(SSL *s, void *arg);
+		/// The return value of this method defines how errors in
+		/// verification are handled. Return 0 to terminate the handshake,
+		/// or 1 to continue .
+
 private:
 	SSLManager();
 		/// Creates the SSLManager.

NetSSL_OpenSSL/src/Context.cpp

@@ -34,6 +34,7 @@ Context::Params::Params():
 	verificationMode(VERIFY_RELAXED),
 	verificationDepth(9),
 	loadDefaultCAs(false),
+	ocspStaplingVerification(false),
 	cipherList("ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH")
 {
 }
@@ -43,7 +44,8 @@ Context::Context(Usage usage, const Params& params):
 	_usage(usage),
 	_mode(params.verificationMode),
 	_pSSLContext(0),
-	_extendedCertificateVerification(true)
+	_extendedCertificateVerification(true),
+	_ocspStaplingResponseVerification(false)	
 {
 	init(params);
 }
@@ -61,7 +63,8 @@ Context::Context(
 	_usage(usage),
 	_mode(verificationMode),
 	_pSSLContext(0),
-	_extendedCertificateVerification(true)
+	_extendedCertificateVerification(true),
+	_ocspStaplingResponseVerification(false)	
 {
 	Params params;
 	params.privateKeyFile = privateKeyFile;
@@ -85,7 +88,8 @@ Context::Context(
 	_usage(usage),
 	_mode(verificationMode),
 	_pSSLContext(0),
-	_extendedCertificateVerification(true)
+	_extendedCertificateVerification(true),
+	_ocspStaplingResponseVerification(false)	
 {
 	Params params;
 	params.caLocation = caLocation;
@@ -174,6 +178,11 @@ void Context::init(const Params& params)
 		SSL_CTX_set_mode(_pSSLContext, SSL_MODE_AUTO_RETRY);
 		SSL_CTX_set_session_cache_mode(_pSSLContext, SSL_SESS_CACHE_OFF);
 
+		if (!isForServerUse() && params.ocspStaplingVerification){
+			_ocspStaplingResponseVerification = true;
+			SSL_CTX_set_tlsext_status_cb(_pSSLContext, &SSLManager::verifyOCSPResponse);
+		}
+
 		initDH(params.dhParamsFile);
 		initECDH(params.ecdhCurve);
 	}

NetSSL_OpenSSL/src/SSLManager.cpp

@@ -25,6 +25,8 @@
 #include "Poco/Util/Application.h"
 #include "Poco/Util/OptionException.h"
 
+#include <openssl/ocsp.h>
+#include <openssl/tls1.h>
 
 namespace Poco {
 namespace Net {
@@ -234,7 +236,23 @@ int SSLManager::privateKeyPassphraseCallback(char* pBuf, int size, int /*flag*/,
 	return size;
 }
 
+int SSLManager::verifyOCSPResponse(SSL *s, void *arg)
+{
+	const unsigned char *p;
+    int len;
+    OCSP_RESPONSE *rsp;
+    len = SSL_get_tlsext_status_ocsp_resp(s, &p);    
+    if (p == NULL) {        
+        return 1;
+    }
+    rsp = d2i_OCSP_RESPONSE(NULL, &p, len);
+    if (rsp == NULL) {                
+        return 0;
+    }   
+    OCSP_RESPONSE_free(rsp);
+    return 1;
 
+}
 void SSLManager::initDefaultContext(bool server)
 {
 	if (server && _ptrDefaultServerContext) return;

NetSSL_OpenSSL/src/SecureSocketImpl.cpp

@@ -163,6 +163,9 @@ void SecureSocketImpl::connectSSL(bool performHandshake)
 		SSL_set_tlsext_host_name(_pSSL, _peerHostName.c_str());
 	}
 #endif
+
+	if(_pContext->ocspStaplingResponseVerificationEnabled())
+		SSL_set_tlsext_status_type(_pSSL, TLSEXT_STATUSTYPE_ocsp);
 
 	if (_pSession)
 	{