From 4f1103a64f080bc8a682593bc2ba511c5be20c46 Mon Sep 17 00:00:00 2001
From: Christian Hohnstaedt <christian@hohnstaedt.de>
Date: Mon, 23 Mar 2020 16:33:26 +0100
Subject: [PATCH] Close #72: Add checkbox for OCSP staple feature

Also support them in XCA template and transformation from
certificate and request.
---
 lib/oid.cpp             |  8 ++++++++
 lib/oid.h               |  3 +++
 lib/pki_temp.cpp        |  2 ++
 ui/NewX509.ui           |  7 +++++++
 widgets/NewX509.cpp     |  1 +
 widgets/NewX509.h       |  1 +
 widgets/NewX509_ext.cpp | 15 +++++++++++++++
 7 files changed, 37 insertions(+)

diff --git a/lib/oid.cpp b/lib/oid.cpp
index a8487f8c..d11491ab 100644
--- a/lib/oid.cpp
+++ b/lib/oid.cpp
@@ -18,6 +18,10 @@
 #include "widgets/XcaWarning.h"
 #include "widgets/MainWindow.h"
 
+#ifndef NID_tlsfeature
+int NID_tlsfeature = NID_undef;
+#endif
+
 int first_additional_oid = 0;
 
 NIDlist extkeyuse_nid;
@@ -194,6 +198,10 @@ void initOIDs()
 	QString dir = getPrefix();
 
 	first_additional_oid = OBJ_new_nid(0);
+#ifndef NID_tlsfeature
+	NID_tlsfeature = OBJ_create("1.3.6.1.5.5.7.1.24", "tlsfeature",
+							"TLS Feature");
+#endif
 	openssl_error();
 	for (int i=0; i<first_additional_oid;i++)
 		addToLowerMap(i);
diff --git a/lib/oid.h b/lib/oid.h
index 5160cea9..8e982c9c 100644
--- a/lib/oid.h
+++ b/lib/oid.h
@@ -14,6 +14,9 @@ class QString;
 
 typedef QList<int> NIDlist;
 
+#ifndef NID_tlsfeature
+extern int NID_tlsfeature;
+#endif
 extern NIDlist extkeyuse_nid;
 extern NIDlist distname_nid;
 
diff --git a/lib/pki_temp.cpp b/lib/pki_temp.cpp
index 108a9180..7f3664cd 100644
--- a/lib/pki_temp.cpp
+++ b/lib/pki_temp.cpp
@@ -44,6 +44,7 @@ const QList<QString> pki_temp::tmpl_keys = {
 	"eKeyUse",
 	"adv_ext",
 	"noWellDefinedExpDate",
+	"OCSPstaple",
 };
 
 pki_temp::pki_temp(const pki_temp *pk)
@@ -207,6 +208,7 @@ extList pki_temp::fromCert(pki_x509super *cert_or_req)
 	}
 	settings["authKey"] = el.delByNid(NID_authority_key_identifier) ? "1" : "0";
 	settings["subKey"] =  el.delByNid(NID_subject_key_identifier) ? "1" : "0";
+	settings["OCSPstaple"] = el.delByNid(NID_tlsfeature) ? "1" : "0";
 
 	int nsCT = bitsToInt(el, NID_netscape_cert_type, NULL);
 	/* bit 4 is unused. Move higher bits down. */
diff --git a/ui/NewX509.ui b/ui/NewX509.ui
index 02bd7239..6faab403 100644
--- a/ui/NewX509.ui
+++ b/ui/NewX509.ui
@@ -854,6 +854,13 @@
          <item row="2" column="0">
           <widget class="DoubleClickLabel" name="crldpLbl"/>
          </item>
+         <item row="4" column="2">
+          <widget class="QCheckBox" name="OCSPstaple">
+           <property name="text">
+            <string notr="true">OCSP Must Staple</string>
+           </property>
+          </widget>
+         </item>
         </layout>
        </item>
       </layout>
diff --git a/widgets/NewX509.cpp b/widgets/NewX509.cpp
index 5e18f8ae..70e1ad31 100644
--- a/widgets/NewX509.cpp
+++ b/widgets/NewX509.cpp
@@ -272,6 +272,7 @@ NewX509::NewX509(QWidget *parent)
 	MAP_CB(ekuCritical);
 	MAP_CB(subKey);
 	MAP_CB(authKey);
+	MAP_CB(OCSPstaple);
 	MAP_CB(validMidn);
 	MAP_CB(noWellDefinedExpDate);
 }
diff --git a/widgets/NewX509.h b/widgets/NewX509.h
index e67eac4d..593033a6 100644
--- a/widgets/NewX509.h
+++ b/widgets/NewX509.h
@@ -91,6 +91,7 @@ class NewX509: public QDialog, public Ui::NewX509
 		x509v3ext getBasicConstraints();
 		x509v3ext getSubKeyIdent();
 		x509v3ext getAuthKeyIdent();
+		x509v3ext getOCSPstaple();
 		x509v3ext getKeyUsage();
 		x509v3ext getEkeyUsage();
 		x509v3ext getSubAltName();
diff --git a/widgets/NewX509_ext.cpp b/widgets/NewX509_ext.cpp
index 4304039c..d5b735de 100644
--- a/widgets/NewX509_ext.cpp
+++ b/widgets/NewX509_ext.cpp
@@ -49,6 +49,20 @@ x509v3ext NewX509::getSubKeyIdent()
 }
 
 
+x509v3ext NewX509::getOCSPstaple()
+{
+	x509v3ext ext;
+	if (OCSPstaple->isChecked())
+		ext.create(NID_tlsfeature,
+#ifdef NID_tlsfeature
+			"status_request",
+#else
+			"DER:30:03:02:01:05",
+#endif
+			&ext_ctx);
+	return ext;
+}
+
 x509v3ext NewX509::getAuthKeyIdent()
 {
 	x509v3ext ext;
@@ -228,6 +242,7 @@ extList NewX509::getGuiExt()
 	ne << getIssAltName();
 	ne << getCrlDist();
 	ne << getAuthInfAcc();
+	ne << getOCSPstaple();
 	openssl_error();
 	return ne;
 }