revocation: OCSP and/or CRL fetching can be disabled

conf/Makefile.am

@@ -80,6 +80,7 @@ plugins = \
 	plugins/radattr.opt \
 	plugins/random.opt \
 	plugins/resolve.opt \
+	plugins/revocation.opt \
 	plugins/socket-default.opt \
 	plugins/sql.opt \
 	plugins/stroke.opt \

conf/plugins/revocation.opt

@@ -0,0 +1,7 @@
+charon.plugins.revocation.enable_ocsp = yes
+	Whether OCSP fetching should be enabled.
+
+charon.plugins.revocation.enable_crl = yes
+        Whether CRL fetching should be enabled.
+
+

src/libstrongswan/plugins/revocation/revocation_validator.c

@@ -36,6 +36,17 @@ struct private_revocation_validator_t {
 	 * Public revocation_validator_t interface.
 	 */
 	revocation_validator_t public;
+
+	/**
+	 * Enable OCSP fetching
+	 */
+	bool enable_ocsp;
+
+	/**
+	 * Enable CRL fetching
+	 */
+	bool enable_crl;
+
 };
 
 /**
@@ -738,6 +749,9 @@ METHOD(cert_validator_t, validate, bool,
 	{
 		DBG1(DBG_CFG, "checking certificate status of \"%Y\"",
 					   subject->get_subject(subject));
+
+		if (this->enable_ocsp)
+		{
 			switch (check_ocsp((x509_t*)subject, (x509_t*)issuer,
 							   pathlen ? NULL : auth))
 			{
@@ -760,6 +774,10 @@ METHOD(cert_validator_t, validate, bool,
 					DBG1(DBG_CFG, "ocsp check failed, fallback to crl");
 					break;
 			}
+		}
+
+		if (this->enable_crl)
+		{
 			switch (check_crl((x509_t*)subject, (x509_t*)issuer,
 							  pathlen ? NULL : auth))
 			{
@@ -780,6 +798,8 @@ METHOD(cert_validator_t, validate, bool,
 					DBG1(DBG_CFG, "certificate status is unknown, crl is stale");
 					break;
 			}
+		}
+
 		lib->credmgr->call_hook(lib->credmgr, CRED_HOOK_VALIDATION_FAILED,
 								subject);
 	}
@@ -804,7 +824,20 @@ revocation_validator_t *revocation_validator_create()
 			.validator.validate = _validate,
 			.destroy = _destroy,
 		},
+		.enable_ocsp = lib->settings->get_bool(lib->settings,
+							"%s.plugins.revocation.enable_ocsp", TRUE, lib->ns),
+		.enable_crl  = lib->settings->get_bool(lib->settings,
+							"%s.plugins.revocation.enable_crl",  TRUE, lib->ns),
 	);
 
+	if (!this->enable_ocsp)
+	{
+		DBG1(DBG_LIB, "all OCSP fetching disabled");
+	}
+	if (!this->enable_crl)
+	{
+		DBG1(DBG_LIB, "all CRL fetching disabled");
+	}
+
 	return &this->public;
 }