xref: /titanic_52/usr/src/lib/libpkg/common/pkgweb.c (revision 6eaad1d3bb5bc6d4b1e87f2660b6d3a6e9fc2155)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
 * Use is subject to license terms.
 */

/* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */


#include <stdio.h>
#include <limits.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <pkglocs.h>
#include <locale.h>
#include <libintl.h>
#include <libgen.h>
#include <signal.h>
#include <sys/stat.h>
#include <sys/statvfs.h>
#include <sys/types.h>
#include <fcntl.h>
#include <dirent.h>
#include <boot_http.h>
#include <errno.h>
#include <ctype.h>
#include <openssl/pkcs7.h>
#include <openssl/ocsp.h>
#include <openssl/pkcs12.h>
#include <openssl/err.h>
#include <openssl/x509.h>
#include <openssl/pem.h>
#include <openssl/evp.h>
#include <openssl/rand.h>
#include <openssl/x509v3.h>
#include "pkglib.h"
#include "pkglibmsgs.h"
#include "pkglocale.h"
#include "keystore.h"
#include "pkgweb.h"
#include "pkgerr.h"
#include "p12lib.h"

/* fixed format when making an OCSP request */
#define	OCSP_REQUEST_FORMAT \
	"POST %s HTTP/1.0\r\n" \
	"Content-Type: application/ocsp-request\r\n" \
	"Content-Length: %d\r\n\r\n"

/*
 * no security is afforded by using this phrase to "encrypt" CA certificates,
 * but it might aid in debugging and has to be non-null
 */
#define	WEB_CA_PHRASE		"schizophrenic"

/* This one needs the ': ' at the end */
#define	CONTENT_TYPE_HDR	"Content-Type"
#define	CONTENT_DISPOSITION_HDR	"Content-Disposition"
#define	CONTENT_OCSP_RESP	"application/ocsp-response"
#define	CONTENT_LENGTH_HDR	"Content-Length"
#define	LAST_MODIFIED_HDR	"Last-Modified"
#define	OCSP_BUFSIZ	1024

/*
 * default amount of time that is allowed for error when checking
 * OCSP response validity.
 * For example, if this is set to 5 minutes, then if a response
 * is issued that is valid from 12:00 to 1:00, then we will
 * accept it if the local time is between 11:55 and 1:05.
 * This takes care of not-quite-synchronized server and client clocks.
 */
#define	OCSP_VALIDITY_PERIOD	(5 * 60)

/* this value is defined by getpassphrase(3c) manpage */
#define	MAX_PHRASELEN		257

/* Max length of "enter password again" prompt message */
#define	MAX_VERIFY_MSGLEN	1024

/* local prototypes */
static boolean_t remove_dwnld_file(char *);
static boolean_t get_ENV_proxyport(PKG_ERR *, ushort_t *);
static boolean_t make_link(char *, char *);
static WebStatus web_send_request(PKG_ERR *, int, int, int);
static boolean_t web_eval_headers(PKG_ERR *);
static WebStatus web_get_file(PKG_ERR *, char *, int, char **);
static boolean_t ck_dwnld_dir_space(PKG_ERR *, char *, ulong_t);
static WebStatus web_connect(PKG_ERR *);
static boolean_t web_setup(PKG_ERR *);
static boolean_t check_dwnld_dir(PKG_ERR *, char *);
static boolean_t parse_url_proxy(PKG_ERR *, char *, char *, ushort_t);
static boolean_t web_disconnect(void);
static char *get_unique_filename(char *, char *);
static boolean_t get_ENV_proxy(PKG_ERR *, char **);
static char *condense_lastmodified(char *);
static int web_verify(int, X509_STORE_CTX *);
static int get_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x);
static boolean_t get_ocsp_uri(X509 *, char **);
static OCSPStatus ocsp_verify(PKG_ERR *, X509 *, X509 *, char *, url_hport_t *,
    STACK_OF(X509) *);
static char	*get_time_string(ASN1_GENERALIZEDTIME *);
static char	*write_ca_file(PKG_ERR *, char *, STACK_OF(X509) *, char *);
static boolean_t _get_random_info(void *, int);
static boolean_t	init_session(void);
static void	progress_setup(int, ulong_t);
static void	progress_report(int, ulong_t);
static void	progress_finish(int);
static char	*replace_token(char *, char, char);
static void	dequote(char *);
static void	trim(char *);


/*
 * structure used to hold data passed back to the
 * X509 verify callback routine in validate_signature()
 */
typedef struct {
	url_hport_t	*proxy;
	PKG_ERR		*err;
	STACK_OF(X509)	*cas;
} verify_cb_data_t;

/* Progress bar variables */
static ulong_t const_increment, const_divider, completed, const_completed;

/* current network backoff wait period */
static int cur_backoff = 0;

/* download session context handle */
static WEB_SESSION *ps;

static int	webpkg_install = 0;
static char	*prompt = NULL;
static char	*passarg = NULL;


/* ~~~~~~~~~~~~~~ Public Functions ~~~~~~~~~~~~~~~~~~~ */

/*
 * Name:		set_prompt
 * Description:	Specifies the prompt to use with the pkglib
 *		passphrase callback routine.
 *
 * Arguments:	newprompt - The prompt to display
 *
 * Returns :	NONE
 */
void
set_passphrase_prompt(char *newprompt)
{
	prompt = newprompt;
}

/*
 * Name:		set_passarg
 * Description:	Specifies the passphrase retrieval method
 *		 to use with the pkglib
 *		passphrase callback routine.
 *
 * Arguments:	newpassarg - The new password retrieval arg
 *
 * Returns :	NONE
 */
void
set_passphrase_passarg(char *newpassarg)
{
	passarg = newpassarg;
}

/*
 * Name:		get_proxy_port
 * Description:	Resolves proxy specification
 *
 * Arguments:	err - where to record any errors.
 *     		proxy - Location to store result - if *proxy is not
 *		null, then it will be validated, but not changed
 *
 * Returns :	B_TRUE - success, B_FALSE otherwise
 *		on success, *proxy and *port are set to either
 *		the user-supplied proxy and port, or the
 *		ones found in the environment variables
 *		HTTPPROXY and/or HTTPROXYPORT
 */
boolean_t
get_proxy_port(PKG_ERR *err, char **proxy, ushort_t *port)
{
	if (*proxy != NULL) {
		if (!path_valid(*proxy)) {
			/* bad proxy supplied */
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_BAD_PROXY), *proxy);
			return (B_FALSE);
		}
		if (!get_ENV_proxyport(err, port)) {
			/* env set, but bad */
			return (B_FALSE);
		}
	} else {
		if (!get_ENV_proxy(err, proxy)) {
			/* environment variable set, but bad */
			return (B_FALSE);
		}
		if ((*proxy != NULL) && !path_valid(*proxy)) {
			/* env variable set, but bad */
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_BAD_PROXY), *proxy);
			return (B_FALSE);
		}
		if (!get_ENV_proxyport(err, port)) {
			/* env variable set, but bad */
			return (B_FALSE);
		}
	}
	return (B_TRUE);
}

/*
 * Name:		path_valid
 * Description:	Checks a string for being a valid path
 *
 * Arguments:	path - path to validate
 *
 * Returns :	B_TRUE - success, B_FALSE otherwise.
 *		B_FALSE means path was null, too long (>PATH_MAX),
 *		or too short (<1)
 */
boolean_t
path_valid(char *path)
{
	if (path == NULL) {
		return (B_FALSE);
	} else if (strlen(path) > PATH_MAX) {
		return (B_FALSE);
	} else if (strlen(path) >= 1) {
		return (B_TRUE);
	} else {
		/* path < 1 */
		return (B_FALSE);
	}
}

/*
 * Name:		web_cleanup
 * Description:	Deletes temp files, closes, frees memory taken
 *		by 'ps' static structure
 *
 * Arguments:	none
 *
 * Returns :	none
 */
void
web_cleanup(void)
{
	PKG_ERR *err;

	if (ps == NULL)
		return;

	err = pkgerr_new();

	if (ps->keystore) {
		(void) close_keystore(err, ps->keystore, NULL);
	}

	ps->keystore = NULL;

	pkgerr_free(err);

	if (ps->uniqfile) {
		(void) remove_dwnld_file(ps->uniqfile);
		free(ps->uniqfile);
		ps->uniqfile = NULL;
	}
	if (ps->link) {
		(void) remove_dwnld_file(ps->link);
		free(ps->link);
		ps->link = NULL;
	}
	if (ps->dwnld_dir) {
	    (void) rmdir(ps->dwnld_dir);
	    ps->dwnld_dir = NULL;
	}
	if (ps->errstr) {
	    free(ps->errstr);
	    ps->errstr = NULL;
	}

	if (ps->content) {
	    free(ps->content);
	    ps->content = NULL;
	}

	if (ps->resp) {
		http_free_respinfo(ps->resp);
		ps->resp = NULL;
	}

	if (ps) {
	    free(ps);
	    ps = NULL;
	}
}

/*
 * Name:		web_session_control
 * Description:	Downloads an arbitrary URL and saves to disk.
 *
 * Arguments:	err - where to record any errors.
 *     		url - URL pointing to content to download - can be
 *			http:// or https://
 *		dwnld_dir - Directory to download into
 *		keystore - keystore to use for accessing trusted
 *			certs when downloading using SSL
 *		proxy - HTTP proxy to use, or NULL for no proxy
 *		proxy_port - HTTP proxy port to use, ignored
 *			if proxy is NULL
 *		passarg - method to retrieve password
 *		retries - # of times to retry download before
 *			giving up
 *		timeout - how long to wait before retrying,
 *			when download is interrupted
 *		nointeract - if non-zero, do not output
 *			download progress to screen
 *
 * Returns :	B_TRUE - success, B_FALSE otherwise
 */
boolean_t
web_session_control(PKG_ERR *err, char *url, char *dwnld_dir,
    keystore_handle_t keystore, char *proxy, ushort_t proxy_port,
    int retries, int timeout, int nointeract, char **fname)
{
	int i;
	boolean_t ret = B_TRUE;
	boolean_t retrieved = B_FALSE;

	if (!init_session()) {
	    ret = B_FALSE;
	    goto cleanup;
	}

	if (!parse_url_proxy(err, url, proxy, proxy_port)) {
		ret = B_FALSE;
		goto cleanup;
	}

	ps->timeout = timeout;

	if (keystore != NULL)
		ps->keystore = keystore;

	if (dwnld_dir != NULL)
		ps->dwnld_dir = xstrdup(dwnld_dir);
	else {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_NO_DWNLD_DIR));
		ret = B_FALSE;
		goto cleanup;
	}

	if (!check_dwnld_dir(err, dwnld_dir)) {
		ret = B_FALSE;
		goto cleanup;
	}

	for (i = 0; i < retries && !retrieved; i++) {
		if (!web_setup(err)) {
			ret = B_FALSE;
			goto cleanup;
		}

		switch (web_connect(err)) {
		    /* time out and wait a little bit for these failures */
		case WEB_OK:
		    /* were able to connect */
			reset_backoff();
			break;
		case WEB_TIMEOUT:
			echo_out(nointeract, gettext(MSG_DWNLD_TIMEOUT));
			(void) web_disconnect();
			backoff();
			continue;

		case WEB_CONNREFUSED:
			echo_out(nointeract, gettext(MSG_DWNLD_CONNREF),
			    ps->url.hport.hostname);
			(void) web_disconnect();
			backoff();
			continue;
		case WEB_HOSTDOWN:
			echo_out(nointeract, gettext(MSG_DWNLD_HOSTDWN),
			    ps->url.hport.hostname);
			(void) web_disconnect();
			backoff();
			continue;

		default:
			/* every other failure is a hard failure, so bail */
			ret = B_FALSE;
			goto cleanup;
		}

		switch (web_send_request(err, HTTP_REQ_TYPE_HEAD,
				ps->data.cur_pos, ps->data.content_length)) {
		case WEB_OK:
		    /* were able to connect */
			reset_backoff();
			break;
		case WEB_TIMEOUT:
			echo_out(nointeract, gettext(MSG_DWNLD_TIMEOUT));
			(void) web_disconnect();
			backoff();
			continue;

		case WEB_CONNREFUSED:
			echo_out(nointeract, gettext(MSG_DWNLD_CONNREF),
			    ps->url.hport.hostname);
			(void) web_disconnect();
			backoff();
			continue;
		case WEB_HOSTDOWN:
			echo_out(nointeract, gettext(MSG_DWNLD_HOSTDWN),
			    ps->url.hport.hostname);
			(void) web_disconnect();
			backoff();
			continue;
		default:
			/* every other case is failure, so bail */
			ret = B_FALSE;
			goto cleanup;
		}

		if (!web_eval_headers(err)) {
			ret = B_FALSE;
			goto cleanup;
		}

		switch (web_get_file(err, dwnld_dir, nointeract, fname)) {
		case WEB_OK:
			/* were able to retrieve file */
			retrieved = B_TRUE;
			reset_backoff();
			break;

		case WEB_TIMEOUT:
			echo_out(nointeract, gettext(MSG_DWNLD_TIMEOUT));
			(void) web_disconnect();
			backoff();
			continue;

		case WEB_CONNREFUSED:
			echo_out(nointeract, gettext(MSG_DWNLD_CONNREF),
			    ps->url.hport.hostname);
			(void) web_disconnect();
			backoff();
			continue;
		case WEB_HOSTDOWN:
			echo_out(nointeract, gettext(MSG_DWNLD_HOSTDWN),
			    ps->url.hport.hostname);
			(void) web_disconnect();
			backoff();
			continue;
		default:
			/* every other failure is a hard failure, so bail */
			ret = B_FALSE;
			goto cleanup;
		}
	}

	if (!retrieved) {
		/* max retries attempted */
		pkgerr_add(err, PKGERR_WEB,
		    gettext(ERR_DWNLD_FAILED), retries);
		ret = B_FALSE;
	}
cleanup:
	(void) web_disconnect();
	if (!ret) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_DWNLD), url);
	}
	return (ret);
}

/*
 * Name:		get_signature
 * Description:	retrieves signature from signed package.
 *
 * Arguments:	err - where to record any errors.
 *		ids_name - name of package stream, for error reporting
 *     		devp - Device on which package resides that we
 *		result - where to store resulting PKCS7 signature
 *
 * Returns :	B_TRUE - package is signed and signature returned OR
 *		package is not signed, in which case result is NULL
 *
 *		B_FALSE - there were problems accessing signature,
 *		and it is unknown whether it is signed or not.  Errors
 *		recorded in 'err'.
 */
boolean_t
get_signature(PKG_ERR *err, char *ids_name, struct pkgdev *devp, PKCS7 **result)
{
	char path[PATH_MAX];
	int len, fd = -1;
	struct stat buf;
	FILE *fp = NULL;
	boolean_t	ret = B_TRUE;
	BIO	*sig_in = NULL;
	PKCS7	*p7 = NULL;

	/*
	 * look for signature.  If one was in the stream,
	 * it is now extracted
	 */
	if (((len = snprintf(path, PATH_MAX, "%s/%s", devp->dirname,
	    SIGNATURE_FILENAME)) >= PATH_MAX) || (len < 0)) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_LEN), ids_name);
		ret = B_FALSE;
		goto cleanup;
	}

	if ((fd = open(path, O_RDONLY|O_NONBLOCK)) == -1) {
		/*
		 * only if the signature is non-existant
		 * do we "pass"
		 */
		if (errno != ENOENT) {
			pkgerr_add(err, PKGERR_WEB, gettext(ERR_OPENSIG),
			    strerror(errno));
			ret = B_FALSE;
			goto cleanup;
		}
	} else {
		/* found sig file.  parse it. */
		if (fstat(fd, &buf) == -1) {
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_OPENSIG), strerror(errno));
			ret = B_FALSE;
			goto cleanup;
		}

		if (!S_ISREG(buf.st_mode)) {
			pkgerr_add(err, PKGERR_WEB, gettext(ERR_OPENSIG),
			    (gettext(ERR_NOT_REG)));
			ret = B_FALSE;
			goto cleanup;
		}

		if ((fp = fdopen(fd, "r")) == NULL) {
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_OPENSIG), strerror(errno));
			ret = B_FALSE;
			goto cleanup;
		}

		/*
		 * read in signature.  If it's invalid, we
		 * punt, unless we're ignoring it
		 */
		if ((sig_in = BIO_new_fp(fp, BIO_NOCLOSE)) == NULL) {
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_OPENSIG), strerror(errno));
			goto cleanup;
		}

		if ((p7 = PEM_read_bio_PKCS7(sig_in,
		    NULL, NULL, NULL)) == NULL) {
			pkgerr_add(err, PKGERR_WEB, gettext(ERR_CORRUPTSIG),
			    ids_name);
			ret = B_FALSE;
			goto cleanup;
		}
		*result = p7;
		p7 = NULL;
	}

cleanup:
	if (sig_in)
		(void) BIO_free(sig_in);
	if (fp)
		(void) fclose(fp);
	if (fd != -1)
		(void) close(fd);
	if (p7)
		(void) PKCS7_free(p7);

	return (ret);
}

/*
 * Name:		echo_out
 * Description:	Conditionally output a message to stdout
 *
 * Arguments:	nointeract - if non-zero, do not output anything
 *		fmt - print format
 *		... - print arguments
 *
 * Returns :	none
 */
/*PRINTFLIKE2*/
void
echo_out(int nointeract, char *fmt, ...)
{
	va_list ap;

	va_start(ap, fmt);

	if (nointeract)
		return;

	(void) vfprintf(stdout, fmt, ap);

	va_end(ap);

	(void) putc('\n', stdout);
}

/*
 * Name:		strip_port
 * Description:	Returns "port" portion of a "hostname:port" string
 *
 * Arguments:	proxy - full "hostname:port" string pointer
 *
 * Returns :	the "port" portion of a "hostname:port" string,
 *		converted to a decimal integer, or (int)0
 *		if string contains no :port suffix.
 */
ushort_t
strip_port(char *proxy)
{
	char *tmp_port;

	if ((tmp_port = strpbrk(proxy, ":")) != NULL)
		return (atoi(tmp_port));
	else
		return (0);
}

/*
 * Name:		set_web_install
 * Description:	Sets flag indicating we are doing a web-based install
 *
 * Arguments:	none
 *
 * Returns :	none
 */
void
set_web_install(void)
{
	webpkg_install++;
}

/*
 * Name:		is_web_install
 * Description:	Determines whether we are doing a web-based install
 *
 * Arguments:	none
 *
 * Returns :	non-zero if we are doing a web-based install, 0 otherwise
 */
int
is_web_install(void)
{
	return (webpkg_install);
}

/* ~~~~~~~~~~~~~~ Private Functions ~~~~~~~~~~~~~~~~~~~ */

/*
 * Name:		web_disconnect
 * Description:	Disconnects connection to web server
 *
 * Arguments:	none
 *
 * Returns :	B_TRUE - successful disconnect, B_FALSE otherwise
 *		Temp certificiate files are deleted,
 *		if one was used to initiate the connection
 *		(such as when using SSL)
 */
static boolean_t
web_disconnect(void)
{
	if (ps->certfile) {
		(void) unlink(ps->certfile);
	}
	if (http_srv_disconnect(ps->hps) == 0)
		if (http_srv_close(ps->hps) == 0)
			return (B_TRUE);

	return (B_FALSE);
}

/*
 * Name:		check_dwnld_dir
 * Description:	Creates temp download directory
 *
 * Arguments:	err - where to record any errors.
 *     		dwnld_dir - name of directory to create
 *
 * Returns :	B_TRUE - success, B_FALSE otherwise
 *		on success, directory is created with
 *		safe permissions
 */
static boolean_t
check_dwnld_dir(PKG_ERR *err, char *dwnld_dir)
{
	DIR *dirp;

	/*
	 * Check the directory passed in. If it doesn't exist, create it
	 * with strict permissions
	 */
	if ((dirp = opendir(dwnld_dir)) == NULL) {
		if (mkdir(dwnld_dir, 0744) == -1) {
			pkgerr_add(err, PKGERR_WEB, gettext(MSG_NOTEMP),
			    dwnld_dir);
			return (B_FALSE);
		}
	}
	if (dirp) {
		(void) closedir(dirp);
	}
	return (B_TRUE);
}

/*
 * Name:		ds_validate_signature
 * Description:	Validates signature found in a package datastream
 *
 * Arguments:	err - where to record any errors.
 *		pkgdev - Package context handle of package to verify
 *		pkgs - Null-terminated List of package name to verify
 *		ids_name - Pathname to stream to validate
 *		p7 - PKCS7 signature decoded from stream header
 *		cas - List of trusted CA certificates
 *		proxy - Proxy to use when doing online validation (OCSP)
 *		nointeract - if non-zero, do not output to screen
 *
 * Returns :	B_TRUE - success, B_FALSE otherwise
 *		success means signature was completely validated,
 *		and contents of stream checked against signature.
 */
boolean_t
ds_validate_signature(PKG_ERR *err, struct pkgdev *pkgdev, char **pkgs,
    char *ids_name, PKCS7 *p7, STACK_OF(X509) *cas,
    url_hport_t *proxy, int nointeract)
{
	BIO			 *p7_bio;
	boolean_t		ret = B_TRUE;

	/* make sure it's a Signed PKCS7 message */
	if (!PKCS7_type_is_signed(p7)) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_CORRUPTSIG_TYPE),
		    ids_name);
		ret = B_FALSE;
		goto cleanup;
	}

	/* initialize PKCS7 object to be filled in */
	if (!PKCS7_get_detached(p7)) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_CORRUPTSIG_DT),
		    ids_name);
		ret = B_FALSE;
		goto cleanup;
	}

	/* dump header and packages into BIO to calculate the message digest */
	if ((p7_bio = PKCS7_dataInit(p7, NULL)) == NULL) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_CORRUPTSIG),
		    ids_name);
		ret = B_FALSE;
		goto cleanup;
	}

	if ((BIO_ds_dump_header(err, p7_bio) != 0) ||
	    (BIO_ds_dump(err, ids_name, p7_bio) != 0)) {
		ret = B_FALSE;
		goto cleanup;
	}
	(void) BIO_flush(p7_bio);

	/* validate the stream and its signature */
	if (!validate_signature(err, ids_name, p7_bio, p7, cas,
	    proxy, nointeract)) {
		ret = B_FALSE;
		goto cleanup;
	}

	/* reset device stream (really bad performance for tapes) */
	(void) ds_close(1);
	(void) ds_init(ids_name, pkgs, pkgdev->norewind);

cleanup:
	return (ret);
}


/*
 * Name:		validate_signature
 * Description:	Validates signature of an arbitrary stream of bits
 *
 * Arguments:	err - where to record any errors.
 *		name - Descriptive name of object being validated,
 *			for good error reporting messages
 *		indata - BIO object to read stream bits from
 *		p7 - PKCS7 signature of stream
 *		cas - List of trusted CA certificates
 *		proxy - Proxy to use when doing online validation (OCSP)
 *		nointeract - if non-zero, do not output to screen
 *
 * Returns :	B_TRUE - success, B_FALSE otherwise
 *		success means signature was completely validated,
 *		and contents of stream checked against signature.
 */
boolean_t
validate_signature(PKG_ERR *err, char *name, BIO *indata, PKCS7 *p7,
    STACK_OF(X509) *cas, url_hport_t *proxy, int nointeract)
{
	STACK_OF(PKCS7_SIGNER_INFO) *sec_sinfos = NULL;

	PKCS7_SIGNER_INFO	*signer = NULL;
	X509_STORE		*sec_truststore = NULL;
	X509_STORE_CTX		*ctx = NULL;
	X509			*signer_cert = NULL, *issuer = NULL;
	STACK_OF(X509)		*chaincerts = NULL;
	int			i, k;
	unsigned long		errcode;
	const char		*err_data = NULL;
	const char		*err_reason = NULL;
	char			*err_string;
	int			err_flags;
	verify_cb_data_t	verify_data;
	char			*signer_sname;
	char			*signer_iname;
	PKCS7_ISSUER_AND_SERIAL	*ias;
	boolean_t		ret = B_TRUE;

	/* only support signed PKCS7 signatures */
	if (!PKCS7_type_is_signed(p7)) {
	    PKCS7err(PKCS7_F_PKCS7_DATAVERIFY, PKCS7_R_WRONG_PKCS7_TYPE);
	    ret = B_FALSE;
	    goto cleanup;
	}

	/* initialize temporary internal trust store used for verification */
	sec_truststore = X509_STORE_new();

	for (i = 0; i < sk_X509_num(cas); i++) {
		if (X509_STORE_add_cert(sec_truststore,
		    sk_X509_value(cas, i)) == 0) {
			pkgerr_add(err, PKGERR_VERIFY, gettext(ERR_MEM));
			ret = B_FALSE;
			goto cleanup;
		}
	}

	/* get signers from the signature */
	if ((sec_sinfos = PKCS7_get_signer_info(p7)) == NULL) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_CORRUPTSIG), name);
		ret = B_FALSE;
		goto cleanup;
	}

	/* verify each signer found in the PKCS7 signature */
	for (k = 0; k < sk_PKCS7_SIGNER_INFO_num(sec_sinfos); k++) {
		signer = sk_PKCS7_SIGNER_INFO_value(sec_sinfos, k);
		signer_cert = PKCS7_cert_from_signer_info(p7, signer);
		signer_sname = get_subject_display_name(signer_cert);
		signer_iname = get_issuer_display_name(signer_cert);

		echo_out(nointeract, gettext(MSG_VERIFY), signer_sname);

		/* find the issuer of the current cert */
		chaincerts = p7->d.sign->cert;
		ias = signer->issuer_and_serial;
		issuer = X509_find_by_issuer_and_serial(chaincerts,
		    ias->issuer, ias->serial);

		/* were we not able to find the issuer cert */
		if (issuer == NULL) {
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_VERIFY_ISSUER),
			    signer_iname, signer_sname);
			ret = B_FALSE;
			goto cleanup;
		}

		/* Lets verify */
		if ((ctx = X509_STORE_CTX_new()) == NULL) {
			pkgerr_add(err, PKGERR_VERIFY, gettext(ERR_MEM));
			ret = B_FALSE;
			goto cleanup;
		}
		(void) X509_STORE_CTX_init(ctx, sec_truststore,
		    issuer, chaincerts);
		(void) X509_STORE_CTX_set_purpose(ctx,
		    X509_PURPOSE_ANY);

		/* callback will perform OCSP on certificates with OCSP data */
		X509_STORE_CTX_set_verify_cb(ctx, web_verify);

		/* pass needed data into callback through the app_data handle */
		verify_data.proxy = proxy;
		verify_data.cas = cas;
		verify_data.err = err;
		(void) X509_STORE_CTX_set_app_data(ctx, &verify_data);

		/* first verify the certificate chain */
		i = X509_verify_cert(ctx);
		if (i <= 0 && ctx->error != X509_V_ERR_CERT_HAS_EXPIRED) {
			signer_sname =
			    get_subject_display_name(ctx->current_cert);
			signer_iname =
			    get_issuer_display_name(ctx->current_cert);
			/* if the verify context holds an error, print it */
			if (ctx->error != X509_V_OK) {
				pkgerr_add(err, PKGERR_VERIFY,
				    gettext(ERR_VERIFY_SIG), signer_sname,
				    signer_iname,
			    (char *)X509_verify_cert_error_string(ctx->error));
			} else {
				/* some other error.  print them all. */
				while ((errcode = ERR_get_error_line_data(NULL,
				    NULL, &err_data, &err_flags)) != 0) {
					size_t errsz;
					err_reason =
					    ERR_reason_error_string(errcode);
					if (err_reason == NULL) {
						err_reason =
						    gettext(ERR_SIG_INT);
					}

					if (!(err_flags & ERR_TXT_STRING)) {
						err_data =
						    gettext(ERR_SIG_INT);
					}
					errsz = strlen(err_reason) +
					    strlen(err_data) + 3;
					err_string = xmalloc(errsz);
					(void) snprintf(err_string, errsz,
					    "%s: %s", err_reason, err_data);
					pkgerr_add(err, PKGERR_VERIFY,
					    gettext(ERR_VERIFY_SIG),
					    signer_sname, signer_iname,
					    err_string);
					free(err_string);
				}
			}
			ret = B_FALSE;
			goto cleanup;
		}

		/* now verify the signature */
		i = PKCS7_signatureVerify(indata, p7, signer, issuer);

		if (i <= 0) {
			/* print out any OpenSSL-specific errors */
			signer_sname =
			    get_subject_display_name(ctx->current_cert);
			signer_iname =
			    get_subject_display_name(ctx->current_cert);
			while ((errcode = ERR_get_error_line_data(NULL,
			    NULL, &err_data, &err_flags)) != 0) {
				err_reason =
				    ERR_reason_error_string(errcode);
				if (err_reason == NULL) {
					err_reason =
					    gettext(ERR_SIG_INT);
				}

				if (!(err_flags & ERR_TXT_STRING)) {
					err_data =
					    gettext(ERR_SIG_INT);
				}
				pkgerr_add(err, PKGERR_VERIFY,
				    gettext(ERR_VERIFY_SIG), signer_sname,
				    signer_iname, err_reason);
				pkgerr_add(err, PKGERR_VERIFY,
				    gettext(ERR_VERIFY_SIG), signer_sname,
				    signer_iname, err_data);
			}
			ret = B_FALSE;
			goto cleanup;
		}

		echo_out(nointeract, gettext(MSG_VERIFY_OK), signer_sname);
	}

	/* signature(s) verified successfully */
cleanup:
	if (ctx)
		X509_STORE_CTX_cleanup(ctx);
	return (ret);
}

/*
 * Name:		web_verify
 * Description:	Callback used by PKCS7_dataVerify when
 *		verifying a certificate chain.
 *
 * Arguments:	err - where to record any errors.
 *     		ctx - The context handle of the current verification operation
 *
 * Returns :	B_TRUE - success, B_FALSE otherwise
 *		if it's '0' (not OK) we simply return it, since the
 *		verification operation has already determined that the
 *		cert is invalid.  if 'ok' is non-zero, then we do our
 *		checks, and return 0 or 1 based on if the cert is
 *		invalid or valid.
 */
static int
web_verify(int ok, X509_STORE_CTX *ctx)
{
	X509	*curr_cert;
	X509	*curr_issuer;
	char	*uri;
	url_hport_t	*proxy;
	PKG_ERR	*err = NULL;
	STACK_OF(X509) *cas;
	if (!ok) {
		/* don't override a verify failure */
		return (ok);
	}


	/* get app data supplied through callback context */
	err = ((verify_cb_data_t *)X509_STORE_CTX_get_app_data(ctx))->err;
	proxy = ((verify_cb_data_t *)X509_STORE_CTX_get_app_data(ctx))->proxy;
	cas = ((verify_cb_data_t *)X509_STORE_CTX_get_app_data(ctx))->cas;

	/* Check revocation status */
	curr_cert = X509_STORE_CTX_get_current_cert(ctx);

	/* this shouldn't happen */
	if (curr_cert == NULL) {
		pkgerr_add(err, PKGERR_INTERNAL, gettext(ERR_PKG_INTERNAL),
		    __FILE__, __LINE__);
		return (0);
	}

	/* don't perform OCSP unless cert has required OCSP extensions */
	if (get_ocsp_uri(curr_cert, &uri)) {
		if (get_issuer(&curr_issuer, ctx, curr_cert) <= 0) {
			/* no issuer! */
			pkgerr_add(err, PKGERR_INTERNAL,
			    gettext(ERR_PKG_INTERNAL),
			    __FILE__, __LINE__);
			return (0);
		}

		/*
		 * ok we have the current cert
		 * and its issuer.  Do the OCSP check
		 */

		/*
		 * OCSP extensions are, by, RFC 2459, never critical
		 * extensions, therefore, we only fail if we were able
		 * to explicitly contact an OCSP responder, and that
		 * responder did not indicate the cert was valid.  We
		 * also fail if user-supplied data could not be parsed
		 * or we run out of memory.  We succeeed for "soft"
		 * failures, such as not being able to connect to the
		 * OCSP responder, or trying to use if the OCSP URI
		 * indicates SSL must be used (which we do not
		 * support)
		 */
		switch (ocsp_verify(err, curr_cert, curr_issuer,
		    uri, proxy, cas)) {
		case OCSPMem:		/* Ran out of memory */
		case OCSPInternal:	/* Some internal error */
		case OCSPVerify:	/* OCSP responder indicated fail */
			return (0);
		}
		/* all other cases are success, or soft failures */
		pkgerr_clear(err);
	}

	return (ok);
}

/*
 * Name:		get_time_string
 * Description:	Generates a human-readable string from an ASN1_GENERALIZED_TIME
 *
 * Arguments:	intime - The time to convert
 *
 * Returns :	A pointer to a static string representing the passed-in time.
 */
static char
*get_time_string(ASN1_GENERALIZEDTIME *intime)
{

	static char	time[ATTR_MAX];
	BIO		*mem;
	char	*p;

	if (intime == NULL) {
		return (NULL);
	}
	if ((mem = BIO_new(BIO_s_mem())) == NULL) {
		return (NULL);
	}

	if (ASN1_GENERALIZEDTIME_print(mem, intime) == 0) {
		(void) BIO_free(mem);
		return (NULL);
	}

	if (BIO_gets(mem, time, ATTR_MAX) <= 0) {
		(void) BIO_free(mem);
		return (NULL);
	}

	(void) BIO_free(mem);

	/* trim the end of the string */
	for (p = time + strlen(time) - 1; isspace(*p); p--) {
		*p = '\0';
	}

	return (time);
}

/*
 * Name:		get_ocsp_uri
 * Description:	Examines an X509 certificate and retrieves the embedded
 *		OCSP Responder URI if one exists.
 *
 * Arguments:	cert - The cert to inspect
 *     		uri - pointer where the newly-allocated URI is placed, if found
 *
 * Returns :	Success if the URI was found.  Appropriate status otherwise.
 */
static boolean_t
get_ocsp_uri(X509 *cert, char **uri)
{
	AUTHORITY_INFO_ACCESS		*aia;
	ACCESS_DESCRIPTION		*ad;
	int				i;

	if (getenv("PKGWEB_TEST_OCSP")) {
		*uri = xstrdup(getenv("PKGWEB_TEST_OCSP"));
		return (B_TRUE);
	}

	/* get the X509v3 extension holding the OCSP URI */
	if ((aia = X509_get_ext_d2i(cert, NID_info_access,
	    NULL, NULL)) != NULL) {
		for (i = 0; i < sk_ACCESS_DESCRIPTION_num(aia); i++) {
			ad = sk_ACCESS_DESCRIPTION_value(aia, i);
			if (OBJ_obj2nid(ad->method) == NID_ad_OCSP) {
				if (ad->location->type == GEN_URI) {
					*uri =
		    xstrdup((char *)ASN1_STRING_data(ad->location->d.ia5));
					return (B_TRUE);
				}
			}
		}
	}

	/* no URI was found */
	return (B_FALSE);
}

/*
 * Name:		ocsp_verify
 * Description:	Attempts to contact an OCSP Responder and ascertain the validity
 *		of an X509 certificate.
 *
 * Arguments:	err - Error object to add error messages to
 *		cert - The cert to validate
 *		issuer - The certificate of the issuer of 'cert'
 *     		uri - The OCSP Responder URI
 *		cas - The trusted CA certificates used to verify the
 *		signed OCSP response
 * Returns :	Success - The OCSP Responder reported a 'good'
 *		status for the cert otherwise, appropriate
 *		error is returned.
 */
static OCSPStatus
ocsp_verify(PKG_ERR *err, X509 *cert, X509 *issuer,
    char *uri, url_hport_t *proxy, STACK_OF(X509) *cas)
{
	OCSP_CERTID		*id;
	OCSP_REQUEST		*req;
	OCSP_RESPONSE		*resp;
	OCSP_BASICRESP		*bs;
	BIO			*cbio, *mem;
	char			ocspbuf[OCSP_BUFSIZ];
	char *host = NULL, *portstr = NULL, *path = "/", *p, *q, *r;
	int		port, status, reason;
	int	len, retval, respcode, use_ssl = 0;
	ASN1_GENERALIZEDTIME	*rev, *thisupd, *nextupd;
	char	*subjname;
	time_t			currtime;
	char			currtimestr[ATTR_MAX];
	unsigned long		errcode;
	const char		*err_reason;

	subjname = get_subject_display_name(cert);

	/* parse the URI into its constituent parts */
	if (OCSP_parse_url(uri, &host, &portstr, &path, &use_ssl) == NULL) {
		pkgerr_add(err, PKGERR_PARSE, gettext(ERR_OCSP_PARSE), uri);
		return (OCSPParse);
	}

	/* we don't currently support SSL-based OCSP Responders */
	if (use_ssl) {
		pkgerr_add(err, PKGERR_PARSE, gettext(ERR_OCSP_UNSUP), uri);
		return (OCSPUnsupported);
	}

	/* default port if none specified */
	if (portstr == NULL) {
		port = (int)URL_DFLT_SRVR_PORT;
	} else {
		port = (int)strtoul(portstr, &r, 10);
		if (*r != '\0') {
			pkgerr_add(err, PKGERR_PARSE,
			    gettext(ERR_OCSP_PARSE), uri);
			return (OCSPParse);
		}
	}

	/* allocate new request structure */
	if ((req = OCSP_REQUEST_new()) == NULL) {
		pkgerr_add(err, PKGERR_PARSE, gettext(ERR_MEM));
		return (OCSPMem);
	}

	/* convert cert and issuer fields into OCSP request data */
	if ((id = OCSP_cert_to_id(NULL, cert, issuer)) == NULL) {
		pkgerr_add(err, PKGERR_PARSE, gettext(ERR_PKG_INTERNAL),
		    __FILE__, __LINE__);
		return (OCSPInternal);
	}

	/* fill out request structure with request data */
	if ((OCSP_request_add0_id(req, id)) == NULL) {
		pkgerr_add(err, PKGERR_PARSE, gettext(ERR_PKG_INTERNAL),
		    __FILE__, __LINE__);
		return (OCSPInternal);
	}

	/* add nonce */
	(void) OCSP_request_add1_nonce(req, NULL, -1);

	/* connect to host, or proxy */
	if (proxy != NULL) {
		if ((cbio = BIO_new_connect(proxy->hostname)) == NULL) {
			pkgerr_add(err, PKGERR_PARSE, gettext(ERR_MEM));
			return (OCSPMem);
		}

		/*
		 * BIO_set_conn_int_port takes an int *, so let's give it one
		 * rather than an ushort_t *
		 */
		port = proxy->port;
		(void) BIO_set_conn_int_port(cbio, &port);
		if (BIO_do_connect(cbio) <= 0) {
			pkgerr_add(err, PKGERR_PARSE,
			    gettext(ERR_OCSP_CONNECT),
			    proxy->hostname, port);
			return (OCSPConnect);
		}
	} else {
		if ((cbio = BIO_new_connect(host)) == NULL) {
			pkgerr_add(err, PKGERR_PARSE, gettext(ERR_MEM));
			return (OCSPMem);
		}

		(void) BIO_set_conn_int_port(cbio, &port);
		if (BIO_do_connect(cbio) <= 0) {
			pkgerr_add(err, PKGERR_PARSE,
			    gettext(ERR_OCSP_CONNECT),
			    host, port);
			return (OCSPConnect);
		}
	}

	/* calculate length of binary request data */
	len = i2d_OCSP_REQUEST(req, NULL);

	/* send the request headers */
	if (proxy != NULL) {
		retval = BIO_printf(cbio, OCSP_REQUEST_FORMAT, uri, len);
	} else {
		retval = BIO_printf(cbio, OCSP_REQUEST_FORMAT, path, len);
	}

	if (retval <= 0) {
		pkgerr_add(err, PKGERR_PARSE, gettext(ERR_OCSP_SEND), host);
		return (OCSPRequest);
	}

	/* send the request binary data */
	if (i2d_OCSP_REQUEST_bio(cbio, req) <= 0) {
		pkgerr_add(err, PKGERR_PARSE, gettext(ERR_OCSP_SEND), host);
		return (OCSPRequest);
	}

	/*
	 * read the response into a memory BIO, so we can 'gets'
	 * (socket bio's don't support BIO_gets)
	 */
	if ((mem = BIO_new(BIO_s_mem())) == NULL) {
		pkgerr_add(err, PKGERR_PARSE, gettext(ERR_MEM));
		return (OCSPMem);
	}

	while ((len = BIO_read(cbio, ocspbuf, OCSP_BUFSIZ))) {
		if (len < 0) {
			pkgerr_add(err, PKGERR_PARSE,
			    gettext(ERR_OCSP_READ), host);
			return (OCSPRequest);
		}
		if (BIO_write(mem, ocspbuf, len) != len) {
			pkgerr_add(err, PKGERR_PARSE, gettext(ERR_MEM));
			return (OCSPMem);
		}
	}

	/* now get the first line of the response */
	if (BIO_gets(mem, ocspbuf, OCSP_BUFSIZ) <= 0) {
		pkgerr_add(err, PKGERR_PARSE, gettext(ERR_OCSP_RESP_PARSE));
		return (OCSPRequest);
	}

	/* parse the header response */
	/* it should look like "HTTP/x.x 200 OK" */

	/* skip past the protocol info */
	for (p = ocspbuf; (*p != '\0') && !isspace(*p); p++)
		continue;

	/* skip past whitespace betwen protocol and start of response code */
	while ((*p != '\0') && isspace(*p)) {
		p++;
	}

	if (*p == '\0') {
		/* premature end */
		pkgerr_add(err, PKGERR_PARSE,
		    gettext(ERR_OCSP_RESP_PARSE), ocspbuf);
		return (OCSPRequest);
	}

	/* find end of response code */
	for (q = p; (*q != NULL) && !isspace(*q); q++)
		continue;

	/* mark end of response code */
	*q++ = '\0';

	/* parse response code */
	respcode = strtoul(p, &r, 10);
	if (*r != '\0') {
		pkgerr_add(err, PKGERR_PARSE,
		    gettext(ERR_OCSP_RESP_PARSE), ocspbuf);
		return (OCSPRequest);
	}

	/* now find beginning of the response string */
	while ((*q != NULL) && isspace(*q)) {
		q++;
	}

	/* trim whitespace from end of message */
	for (r = (q + strlen(q) - 1); isspace(*r); r--) {
		*r = '\0';
	}

	/* response must be OK */
	if (respcode != 200) {
		pkgerr_add(err, PKGERR_PARSE,
		    gettext(ERR_OCSP_RESP_NOTOK), 200,
		    respcode, q);
		return (OCSPRequest);
	}

	/* read headers, looking for content-type or a blank line */
	while (BIO_gets(mem, ocspbuf, OCSP_BUFSIZ) > 0) {

		/* if we get a content type, make sure it's the right type */
		if (ci_strneq(ocspbuf, CONTENT_TYPE_HDR,
		    strlen(CONTENT_TYPE_HDR))) {

			/* look for the delimiting : */
			p = strchr(ocspbuf + strlen(CONTENT_TYPE_HDR), ':');

			if (p == NULL) {
				pkgerr_add(err, PKGERR_PARSE,
				    gettext(ERR_OCSP_RESP_PARSE), ocspbuf);
				return (OCSPResponder);
			}

			/* skip over ':' */
			p++;

			/* find beginning of the content type */
			while ((*p != NULL) && isspace(*p)) {
				p++;
			}

			if (!ci_strneq(p, CONTENT_OCSP_RESP,
			    strlen(CONTENT_OCSP_RESP))) {
				/* response is not right type */
				pkgerr_add(err, PKGERR_PARSE,
				    gettext(ERR_OCSP_RESP_TYPE),
				    p, CONTENT_OCSP_RESP);
				return (OCSPResponder);
			}

			/* continue with next header line */
			continue;
		}

		/* scan looking for a character */
		for (p = ocspbuf; (*p != '\0') && isspace(*p); p++) {
			continue;
		}
		/*
		 * if we got to the end of the line with
		 *  no chars, then this is a blank line
		 */
		if (*p == '\0') {
			break;
		}
	}


	if (*p != '\0') {
		/* last line was not blank */
		pkgerr_add(err, PKGERR_PARSE,
		    gettext(ERR_OCSP_RESP_PARSE), ocspbuf);
		return (OCSPResponder);
	}

	/* now read in the binary response */
	if ((resp = d2i_OCSP_RESPONSE_bio(mem, NULL)) == NULL) {
		pkgerr_add(err, PKGERR_PARSE, gettext(ERR_OCSP_READ), host);
		return (OCSPResponder);
	}

	/* free temp BIOs */
	(void) BIO_free(mem);
	(void) BIO_free_all(cbio);
	cbio = NULL;

	/* make sure request was successful */
	if (OCSP_response_status(resp) != OCSP_RESPONSE_STATUS_SUCCESSFUL) {
		pkgerr_add(err, PKGERR_PARSE, gettext(ERR_OCSP_RESP_NOTOK),
		    OCSP_RESPONSE_STATUS_SUCCESSFUL,
		    OCSP_response_status(resp),
		    OCSP_response_status_str(OCSP_response_status(resp)));
		return (OCSPResponder);
	}

	/* parse binary response into internal structure */
	if ((bs = OCSP_response_get1_basic(resp)) == NULL) {
		pkgerr_add(err, PKGERR_PARSE, gettext(ERR_OCSP_READ), host);
		return (OCSPParse);
	}

	/*
	 * From here to the end of the code, the return values
	 * should be hard failures
	 */

	/* verify the response, warn if no nonce */
	if (OCSP_check_nonce(req, bs) <= 0) {
		logerr(pkg_gt(WRN_OCSP_RESP_NONCE));
	}

	if (OCSP_basic_verify(bs, cas, NULL, OCSP_TRUSTOTHER) <= 0) {
		while ((errcode = ERR_get_error()) != NULL) {
			err_reason = ERR_reason_error_string(errcode);
			if (err_reason == NULL) {
				err_reason =
				    gettext(ERR_SIG_INT);
			}
			pkgerr_add(err, PKGERR_PARSE, (char *)err_reason);
		}
		pkgerr_add(err, PKGERR_PARSE, gettext(ERR_OCSP_VERIFY_FAIL),
		    uri);
		return (OCSPVerify);
	}

	/* check the validity of our certificate */
	if (OCSP_resp_find_status(bs, id, &status, &reason,
	    &rev, &thisupd, &nextupd) == NULL) {
		pkgerr_add(err, PKGERR_PARSE,
		    gettext(ERR_OCSP_VERIFY_NO_STATUS), subjname);
		return (OCSPVerify);
	}

	if ((currtime = time(NULL)) == (time_t)-1) {
		pkgerr_add(err, PKGERR_PARSE,
		    gettext(ERR_OCSP_VERIFY_NOTIME));
		return (OCSPVerify);
	}

	(void) strlcpy(currtimestr, ctime(&currtime), ATTR_MAX);

	/* trim end */
	for (r = currtimestr + strlen(currtimestr) - 1;
		isspace(*r); r--) {
		*r = '\0';
	}

	if (!OCSP_check_validity(thisupd, nextupd,
	    OCSP_VALIDITY_PERIOD, -1)) {
		if (nextupd != NULL) {
			pkgerr_add(err, PKGERR_PARSE,
			    gettext(ERR_OCSP_VERIFY_VALIDITY),
			    get_time_string(thisupd), get_time_string(nextupd),
			    currtimestr);
		} else {
			pkgerr_add(err, PKGERR_PARSE,
			    gettext(ERR_OCSP_VERIFY_VALIDITY),
			    get_time_string(thisupd),
			    currtimestr);
		}
		return (OCSPVerify);
	}

	if (status != V_OCSP_CERTSTATUS_GOOD) {
		pkgerr_add(err, PKGERR_PARSE,
		    gettext(ERR_OCSP_VERIFY_STATUS), subjname,
		    OCSP_cert_status_str(status));
		return (OCSPVerify);
	}

	/* everythign checks out */
	return (OCSPSuccess);
}

/*
 * Name:		get_issuer
 * Description:	Attempts to find the issuing certificate for a given certificate
 *		This will look in both the list of trusted certificates found in
 *		the X509_STORE_CTX structure, as well as the list of untrusted
 *		chain certificates found in the X509_STORE_CTX structure.
 * Arguments:
 *		issuer - The resulting issuer cert is placed here, if found
 *		ctx - The current verification context
 *		x - The certificate whose issuer we are looking for
 * Returns :	Success - The issuer cert was found and placed in *issuer.
 *		otherwise, appropriate error is returned.
 */
static int
get_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
{
	int		i, ok;

	/*
	 * first look in the list of trusted
	 * certs, using the context's method to do so
	 */
	if ((ok = ctx->get_issuer(issuer, ctx, x)) > 0) {
		return (ok);
	}

	if (ctx->untrusted != NULL) {
		/* didn't find it in trusted certs, look through untrusted */
		for (i = 0; i < sk_X509_num(ctx->untrusted); i++) {
			if (X509_check_issued(sk_X509_value(ctx->untrusted, i),
			    x) == X509_V_OK) {
				*issuer = sk_X509_value(ctx->untrusted, i);
				return (1);
			}
		}
	}
	*issuer = NULL;
	return (0);
}

/*
 * Name:		parse_url_proxy
 * Description:	Parses URL and optional proxy specification, populates static
 *		'ps' structure
 *
 * Arguments:	err - where to record any errors.
 *		url - URL to parse
 *		proxy - proxy to parse, or NULL for no proxy
 *		proxy_port - Default proxy port to use if no proxy
 *		port specified in 'proxy'
 *
 * Returns :	B_TRUE - success, B_FALSE otherwise
 *		on success, 'ps->url' and 'ps->proxy' are populated
 *		with parsed data.
 */
static boolean_t
parse_url_proxy(PKG_ERR *err, char *url, char *proxy, ushort_t proxy_port)
{
	boolean_t ret = B_TRUE;
	if (!path_valid(url)) {
		ret = B_FALSE;
		goto cleanup;
	}

	if (url_parse(url, &ps->url) != URL_PARSE_SUCCESS) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_PARSE_URL), url);
		ret = B_FALSE;
		goto cleanup;
	}

	if (proxy != NULL) {
		if (url_parse_hostport(proxy, &ps->proxy, proxy_port)
				!= URL_PARSE_SUCCESS) {
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_BAD_PROXY), proxy);
			ret = B_FALSE;
			goto cleanup;
		}
	}

cleanup:
	return (ret);
}

/*
 * Name:		web_setup
 * Description:	Initializes http library settings
 *
 * Arguments:	err - where to record any errors.
 *
 * Returns :	B_TRUE - success, B_FALSE otherwise
 */
static boolean_t
web_setup(PKG_ERR *err)
{
	boolean_t ret = B_TRUE;
	static boolean_t keepalive = B_TRUE;

	if ((ps->hps = http_srv_init(&ps->url)) == NULL) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_INIT_SESS), ps->url);
		ret = B_FALSE;
		goto cleanup;
	}

	if (getenv("WEBPKG_DEBUG") != NULL) {
		http_set_verbose(B_TRUE);
	}

	if (ps->proxy.hostname[0] != '\0' &&
			http_set_proxy(ps->hps, &ps->proxy) != 0) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_INIT_SESS), ps->url);
		ret = B_FALSE;
		goto cleanup;
	}
	if (http_set_keepalive(ps->hps, keepalive) != 0) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_INIT_SESS), ps->url);
		ret = B_FALSE;
		goto cleanup;
	}
	if (http_set_socket_read_timeout(ps->hps, ps->timeout) != 0) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_INIT_SESS), ps->url);
		ret = B_FALSE;
		goto cleanup;
	}
	if (http_set_random_file(ps->hps, RANDOM) != 0) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_INIT_SESS), ps->url);
		ret = B_FALSE;
		goto cleanup;
	}

	(void) http_set_p12_format(B_TRUE);

cleanup:
	return (ret);
}

/*
 * Name:		web_connect
 * Description:	Makes connection with URL stored in static 'ps' structure.
 *
 * Arguments:	err - where to record any errors.
 *
 * Returns :   	WEB_OK - connection successful
 *		WEB_VERIFY_SETUP - Unable to complete necessary
 *			SSL setup
 *		WEB_CONNREFUSED - Connection was refused to web site
 *		WEB_HOSTDOWN - Host was not responding to request
 *		WEB_NOCONNECT - Some other connection failure
 */
static WebStatus
web_connect(PKG_ERR *err)
{
	STACK_OF(X509)  *sec_cas = NULL;
	char *path;
	WebStatus ret = WEB_OK;
	ulong_t		errcode;
	uint_t		errsrc;
	int		my_errno = 0;
	const char		*libhttperr = NULL;

	if (ps->url.https == B_TRUE) {
		/* get CA certificates */
		if (find_ca_certs(err, ps->keystore, &sec_cas) != 0) {
			ret = WEB_VERIFY_SETUP;
			goto cleanup;
		}

		if (sk_X509_num(sec_cas) < 1) {
			/* no trusted websites */
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_KEYSTORE_NOTRUST));
			ret = WEB_VERIFY_SETUP;
			goto cleanup;
		}

		/*
		 * write out all CA certs to temp file.  libwanboot should
		 * have an interface for giving it a list of trusted certs
		 * through an in-memory structure, but currently that does
		 * not exist
		 */
		if ((path = write_ca_file(err, ps->dwnld_dir, sec_cas,
		    WEB_CA_PHRASE)) == NULL) {
			ret = WEB_VERIFY_SETUP;
			goto cleanup;
		}

		ps->certfile = path;
		if (http_set_password(ps->hps, WEB_CA_PHRASE) != 0) {
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_HTTPS_PASSWD));
			ret = WEB_VERIFY_SETUP;
			goto cleanup;
		}

		if (http_set_certificate_authority_file(path) != 0) {
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_HTTPS_CA));
			ret = WEB_VERIFY_SETUP;
			goto cleanup;
		}
	}

	if (http_srv_connect(ps->hps) != 0) {
		while ((errcode = http_get_lasterr(ps->hps, &errsrc)) != 0) {
			/* Have an error - is it EINTR? */
			if (errsrc == ERRSRC_SYSTEM) {
				my_errno = errcode;
				break;
			} else if (libhttperr == NULL) {
				/* save the first non-system error message */
				libhttperr = http_errorstr(errsrc, errcode);
			}
		}
		switch (my_errno) {
		case EINTR:
		case ETIMEDOUT:
				/* Timed out.  Try, try again */
			ret = WEB_TIMEOUT;
			break;
		case ECONNREFUSED:
			ret = WEB_CONNREFUSED;
			break;
		case EHOSTDOWN:
			ret = WEB_HOSTDOWN;
			break;
		default:
				/* some other fatal error */
			ret = WEB_NOCONNECT;
			if (libhttperr == NULL) {
				pkgerr_add(err, PKGERR_WEB,
				    gettext(ERR_INIT_CONN),
				    ps->url.hport.hostname);
			} else {
				pkgerr_add(err, PKGERR_WEB,
				    gettext(ERR_HTTP), libhttperr);
			}
			break;
		}
	}
cleanup:
	return (ret);
}

/*
 * Name:		write_ca_file
 * Description:	Writes out a PKCS12 file containing all trusted certs
 *		found in keystore recorded in static 'ps' structure
 *
 *		This routine is used because the libwanboot library's
 *		HTTPS routines cannot accept trusted certificates
 *		through an in-memory structure, when initiating an
 *		SSL connection.  They must be in a PKCS12, which is
 *		admittedly a poor interface.
 *
 * Arguments:	err - where to record any errors.
 *     		tmpdir - Directory to write certificate file in
 *		cacerts - Certs to write out
 *		passwd - password used to encrypt certs
 *
 * Returns :	path to resulting file, if successfullly written,
 *		otherwise NULL.
 */
static char
*write_ca_file(PKG_ERR *err, char *tmpdir, STACK_OF(X509) *cacerts,
    char *passwd)
{
	int fd, len;
	FILE *fp;
	PKCS12	*p12 = NULL;
	char *ret = NULL;
	static char tmp_file[PATH_MAX] = "";
	struct stat buf;

	if (!path_valid(tmpdir)) {
		pkgerr_add(err, PKGERR_WEB, gettext(MSG_NOTEMP), tmpdir);
		goto cleanup;
	}

	/* mkstemp replaces XXXXXX with a unique string */
	if (((len = snprintf(tmp_file, PATH_MAX, "%s/%sXXXXXX", tmpdir,
	    "cert")) < 0) ||
	    (len >= PATH_MAX)) {
		pkgerr_add(err, PKGERR_WEB, gettext(MSG_NOTEMP), tmpdir);
		goto cleanup;
	}

	if ((fd = mkstemp(tmp_file)) == -1) {
		pkgerr_add(err, PKGERR_WEB, gettext(MSG_NOTMPFIL), tmp_file);
		goto cleanup;
	}

	if (fstat(fd, &buf) == -1) {
		pkgerr_add(err, PKGERR_WEB, gettext(MSG_NOTMPFIL), tmp_file);
		goto cleanup;
	}

	if (!S_ISREG(buf.st_mode)) {
		pkgerr_add(err, PKGERR_WEB, gettext(MSG_NOTMPFIL), tmp_file);
		goto cleanup;
	}

	if ((fp = fdopen(fd, "w")) == NULL) {
		pkgerr_add(err, PKGERR_WEB, gettext(MSG_NOTMPFIL), tmp_file);
		goto cleanup;
	}

	if ((p12 = sunw_PKCS12_create(passwd, NULL, NULL, cacerts)) == NULL) {
		pkgerr_add(err, PKGERR_WEB,
		    gettext(ERR_KEYSTORE_FORM), tmp_file);
		goto cleanup;
	}

	if (i2d_PKCS12_fp(fp, p12) == 0) {
		pkgerr_add(err, PKGERR_WEB,
		    gettext(ERR_KEYSTORE_FORM), tmp_file);
		goto cleanup;
	}

	(void) fflush(fp);
	(void) fclose(fp);
	(void) close(fd);
	fp = NULL;
	fd = -1;
	ret = tmp_file;

cleanup:
	if (p12 != NULL)
		PKCS12_free(p12);
	if (fp != NULL)
		(void) fclose(fp);
	if (fd != -1) {
		(void) close(fd);
		(void) unlink(tmp_file);
	}

	return (ret);
}

/*
 * Name:		web_send_request
 * Description:	Sends an HTTP request for a file to the
 *		web server being communicated with in the static
 *		'ps' structure
 *
 * Arguments:	err - where to record any errors.
 *		request_type - HTTP_REQ_TYPE_HEAD to send an HTTP HEAD request,
 *		or HTTP_REQ_TYPE_GET to send an HTTP GET request
 *		cp -
 * Returns :   	WEB_OK - request sent successfully
 *		WEB_CONNREFUSED - Connection was refused to web site
 *		WEB_HOSTDOWN - Host was not responding to request
 *		WEB_NOCONNECT - Some other connection failure
 */
static WebStatus
web_send_request(PKG_ERR *err, int request_type, int cp, int ep)
{
	WebStatus ret = WEB_OK;
	ulong_t		errcode;
	uint_t		errsrc;
	int		my_errno = 0;
	const char		*libhttperr = NULL;
	switch (request_type) {
	case HTTP_REQ_TYPE_HEAD:
		if ((http_head_request(ps->hps, ps->url.abspath)) != 0) {
			while ((errcode = http_get_lasterr(ps->hps,
			    &errsrc)) != 0) {
				/* Have an error - is it EINTR? */
			    if (errsrc == ERRSRC_SYSTEM) {
				    my_errno = errcode;
				    break;
			    } else if (libhttperr == NULL) {
				    /* save first non-system error message */
				    libhttperr =
					http_errorstr(errsrc, errcode);
			    }
			}
			switch (my_errno) {
			    case EINTR:
			case ETIMEDOUT:
				/* Timed out.  Try, try again */
				ret = WEB_TIMEOUT;
				break;
			case ECONNREFUSED:
				ret = WEB_CONNREFUSED;
				break;
			case EHOSTDOWN:
				ret = WEB_HOSTDOWN;
				break;
			default:
				/* some other fatal error */
				ret = WEB_NOCONNECT;
				if (libhttperr == NULL) {
					pkgerr_add(err, PKGERR_WEB,
					    gettext(ERR_INIT_CONN),
					    ps->url.hport.hostname);
				} else {
					pkgerr_add(err, PKGERR_WEB,
					    gettext(ERR_HTTP), libhttperr);
				}
				break;
			}
			goto cleanup;
			}
		break;

	case HTTP_REQ_TYPE_GET:
		if (cp && ep) {
			if (http_get_range_request(ps->hps, ps->url.abspath,
			    cp, ep - cp) != 0) {
				while ((errcode = http_get_lasterr(ps->hps,
				    &errsrc)) != 0) {
					/* Have an error - is it EINTR? */
					if (errsrc == ERRSRC_SYSTEM) {
						my_errno = errcode;
						break;
					} else {
						/*
						 * save first non-system
						 * error message
						 */
						libhttperr =
						    http_errorstr(errsrc,
							errcode);
					}
				}
				switch (my_errno) {
				case EINTR:
				case ETIMEDOUT:
					/* Timed out.  Try, try again */
					ret = WEB_TIMEOUT;
					break;
				case ECONNREFUSED:
					ret = WEB_CONNREFUSED;
					break;
				case EHOSTDOWN:
					ret = WEB_HOSTDOWN;
					break;
				default:
					/* some other fatal error */
					ret = WEB_NOCONNECT;
					if (libhttperr == NULL) {
						pkgerr_add(err, PKGERR_WEB,
						    gettext(ERR_INIT_CONN),
						    ps->url.hport.hostname);
					} else {
						pkgerr_add(err, PKGERR_WEB,
						    gettext(ERR_HTTP),
						    libhttperr);
					}
					break;
				}
				goto cleanup;
			}

			if (!web_eval_headers(err)) {
				ret = WEB_NOCONNECT;
				goto cleanup;
			}
		} else {
			if ((http_get_request(ps->hps, ps->url.abspath))
					!= 0) {
				while ((errcode = http_get_lasterr(ps->hps,
				    &errsrc)) != 0) {
					/* Have an error - is it EINTR? */
					if (errsrc == ERRSRC_SYSTEM) {
						my_errno = errcode;
						break;
					} else {
						/*
						 * save the first non-system
						 * error message
						 */
						libhttperr =
						    http_errorstr(errsrc,
							errcode);
					}
				}
				switch (my_errno) {
				case EINTR:
				case ETIMEDOUT:
					/* Timed out.  Try, try again */
					ret = WEB_TIMEOUT;
					break;
				case ECONNREFUSED:
					ret = WEB_CONNREFUSED;
					break;
				case EHOSTDOWN:
					ret = WEB_HOSTDOWN;
					break;
				default:
					/* some other fatal error */
					ret = WEB_NOCONNECT;
					if (libhttperr == NULL) {
						pkgerr_add(err, PKGERR_WEB,
						    gettext(ERR_INIT_CONN),
						    ps->url.hport.hostname);
					} else {
						pkgerr_add(err, PKGERR_WEB,
						    gettext(ERR_HTTP),
						    libhttperr);
					}
					break;
				}
				goto cleanup;
			}

			if (!web_eval_headers(err)) {
				ret = WEB_NOCONNECT;
				goto cleanup;
			}
		}
		break;
	default:
		pkgerr_add(err, PKGERR_INTERNAL, gettext(ERR_PKG_INTERNAL),
		    __FILE__, __LINE__);
	}

cleanup:
	return (ret);
}

/*
 * Name:		web_eval_headers
 * Description:	Evaluates HTTP headers returned during an HTTP request.
 *		This must be called before calling
 *		http_get_header_value().
 *
 * Arguments:	err - where to record any errors.
 *
 * Returns :	B_TRUE - success, B_FALSE otherwise
 */
static boolean_t
web_eval_headers(PKG_ERR *err)
{
	const char *http_err;
	ulong_t herr;
	uint_t errsrc;

	if (http_process_headers(ps->hps, &ps->resp) != 0) {
		if ((ps->resp != NULL) && (ps->resp->statusmsg != NULL)) {
			pkgerr_add(err, PKGERR_WEB, gettext(ERR_HTTP),
			    ps->resp->statusmsg);
		}

		herr = http_get_lasterr(ps->hps, &errsrc);
		http_err = http_errorstr(errsrc, herr);
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_HTTP),
		    http_err);
		return (B_FALSE);
	}
	return (B_TRUE);
}

/*
 * Name:		web_get_file
 * Description:	Downloads the file URL from the website, all of
 *		which are recorded in the static 'ps' struct
 *
 * Arguments:	err - where to record any errors.
 *		dwnld_dir - Directory to download file into
 *		device - Where to store path to resulting
 *			file
 *		nointeract - if non-zero, do not output
 *		progress
 *		fname - name of downloaded file link in the dwnld_dir
 *
 * Returns :   	WEB_OK - download successful
 *		WEB_CONNREFUSED - Connection was refused to web site
 *		WEB_HOSTDOWN - Host was not responding to request
 *		WEB_GET_FAIL - Unable to initialize download
 *		state (temp file creation, header parsing, etc)
 *		WEB_NOCONNECT - Some other connection failure
 */
static WebStatus
web_get_file(PKG_ERR *err, char *dwnld_dir, int nointeract, char **fname)
{
	int		i, fd;
	int		n = 0;
	ulong_t		abs_pos = 0;
	char		*head_val = NULL;
	char		*lastmod_val = NULL;
	char		*bname = NULL;
	struct stat	status;
	WebStatus	ret = WEB_OK;
	WebStatus	req_ret;
	ulong_t		errcode;
	uint_t		errsrc;
	int		my_errno = 0;
	const char	*libhttperr = NULL;
	char		*disp;
	char		tmp_file[PATH_MAX];
	int		len;

	ps->data.prev_cont_length =
	ps->data.content_length =
	ps->data.cur_pos = 0;

	if ((head_val = http_get_header_value(ps->hps,
	    CONTENT_LENGTH_HDR)) != NULL) {
		ps->data.content_length = atol(head_val);
	} else {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_NO_HEAD_VAL),
		    CONTENT_LENGTH_HDR);
		ret = WEB_GET_FAIL;
		goto cleanup;
	}

	free(head_val);
	head_val = NULL;

	if ((head_val = http_get_header_value(ps->hps,
	    CONTENT_DISPOSITION_HDR)) != NULL) {
		/* "inline; parm=val; parm=val */
		if ((disp = strtok(head_val, "; \t\n\f\r")) != NULL) {
			/* disp = "inline" */
			while ((disp = strtok(NULL, "; \t\n\f\r")) != NULL) {
				/* disp = "parm=val" */
				if (ci_strneq(disp, "filename=", 9)) {
					bname = xstrdup(basename(disp + 9));
					trim(bname);
					dequote(bname);
				}
			}
		}
		free(head_val);
		head_val = NULL;
	}

	if (bname == NULL) {
		/*
		 * couldn't determine filename from header value,
		 * so take basename of URL
		 */
		if ((bname = get_endof_string(ps->url.abspath, '/')) == NULL) {
			/* URL is bad */
			pkgerr_add(err, PKGERR_PARSE,
			    gettext(ERR_PARSE_URL), ps->url.abspath);
			ret = WEB_GET_FAIL;
			goto cleanup;
		}
	}

	*fname = bname;

	if ((head_val = http_get_header_value(ps->hps, LAST_MODIFIED_HDR))
			!= NULL) {

		if ((lastmod_val = condense_lastmodified(head_val)) == NULL) {
			pkgerr_add(err, PKGERR_WEB, gettext(ERR_BAD_HEAD_VAL),
			    LAST_MODIFIED_HDR, head_val);
			ret = WEB_GET_FAIL;
			goto cleanup;
		}
		free(head_val);
		head_val = NULL;

		if ((ps->uniqfile = get_unique_filename(dwnld_dir,
		    lastmod_val)) == NULL) {
			pkgerr_add(err, PKGERR_WEB, gettext(ERR_OPEN_TMP));
			ret = WEB_GET_FAIL;
			goto cleanup;
		}

		free(lastmod_val);
		lastmod_val = NULL;

		if ((fd = open(ps->uniqfile,
		    O_NONBLOCK|O_RDWR|O_APPEND|O_CREAT|O_EXCL,
		    640)) == -1) {

			/*
			 * A partial downloaded file
			 * already exists, so open it.
			 */
			if ((fd = open(ps->uniqfile,
			    O_NONBLOCK|O_RDWR|O_APPEND)) != -1) {
				if (fstat(fd, &status) == -1 ||
				    !S_ISREG(status.st_mode)) {
					pkgerr_add(err, PKGERR_WEB,
					    gettext(ERR_DWNLD_NO_CONT),
					    ps->uniqfile);
					ret = WEB_GET_FAIL;
					goto cleanup;
				} else {
					echo_out(nointeract,
					    gettext(MSG_DWNLD_PART),
					    ps->uniqfile,
					    status.st_size);
					ps->data.prev_cont_length =
					    status.st_size;
				}
			} else {
				/* unable to open partial file */
				pkgerr_add(err, PKGERR_WEB,
				    gettext(ERR_DWNLD_NO_CONT),
				    ps->uniqfile);
				ret = WEB_GET_FAIL;
				goto cleanup;
			}
		}
	} else {
		/*
		 * no "Last-Modified" header, so this file is not eligible for
		 * spooling and "resuming last download" operations
		 */
		ps->spool = B_FALSE;

		/* mkstemp replaces XXXXXX with a unique string */
		if (((len = snprintf(tmp_file, PATH_MAX,
		    "%s/%sXXXXXX", dwnld_dir, "stream")) < 0) ||
		    (len >= PATH_MAX)) {
			pkgerr_add(err, PKGERR_WEB,
			    gettext(MSG_NOTEMP), dwnld_dir);
			ret = WEB_GET_FAIL;
			goto cleanup;
		}

		if ((fd = mkstemp(tmp_file)) == -1) {
			pkgerr_add(err, PKGERR_WEB,
			    gettext(MSG_NOTMPFIL), tmp_file);
			ret = WEB_GET_FAIL;
			goto cleanup;
		}

		if (fstat(fd, &status) == -1 ||
		    !S_ISREG(status.st_mode)) {
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_DWNLD_NO_CONT),
			    ps->uniqfile);
			ret = WEB_GET_FAIL;
			goto cleanup;
		}

		ps->data.prev_cont_length = 0;
		ps->uniqfile = xstrdup(tmp_file);
	}

	/* File has already been completely downloaded */
	if (ps->data.prev_cont_length == ps->data.content_length) {
		echo_out(nointeract, gettext(MSG_DWNLD_PREV), ps->uniqfile);
		ps->data.cur_pos = ps->data.prev_cont_length;
		if (!make_link(dwnld_dir, bname)) {
			pkgerr_add(err, PKGERR_WEB, gettext(MSG_NOTEMP),
			    dwnld_dir);
			ret = WEB_GET_FAIL;
			goto cleanup;
		}
		/* we're done, so cleanup and return success */
		goto cleanup;
	} else if (ps->data.prev_cont_length != 0) {
		ps->data.cur_pos = ps->data.prev_cont_length;
	}

	if (!ck_dwnld_dir_space(err, dwnld_dir,
	    (ps->data.prev_cont_length != 0) ?
	    (ps->data.content_length - ps->data.cur_pos) :
	    ps->data.content_length)) {
		ret = WEB_GET_FAIL;
		goto cleanup;
	}

	if ((req_ret = web_send_request(err, HTTP_REQ_TYPE_GET,
	    ps->data.cur_pos, ps->data.content_length)) != WEB_OK) {
		ret = req_ret;
		goto cleanup;
	}

	if (ps->data.prev_cont_length != 0)
		echo_out(nointeract, gettext(MSG_DWNLD_CONT));
	else
		echo_out(nointeract, gettext(MSG_DWNLD));

	progress_setup(nointeract, ps->data.content_length);

	/* Download the file a BLOCK at a time */
	while (ps->data.cur_pos < ps->data.content_length) {
		progress_report(nointeract, abs_pos);
		i = ((ps->data.content_length - ps->data.cur_pos) < BLOCK) ?
		    (ps->data.content_length - ps->data.cur_pos)
				: BLOCK;
		if ((n = http_read_body(ps->hps, ps->content, i)) <= 0) {
			while ((errcode = http_get_lasterr(ps->hps,
			    &errsrc)) != 0) {
				/* Have an error - is it EINTR? */
				if (errsrc == ERRSRC_SYSTEM) {
					my_errno = errcode;
					break;
				} else {
					/*
					 * save first non-system
					 * error message
					 */
					libhttperr =
					    http_errorstr(errsrc, errcode);
				}
			}
			switch (my_errno) {
			case EINTR:
			case ETIMEDOUT:
				/* Timed out.  Try, try again */
				ret = WEB_TIMEOUT;
				break;
			case ECONNREFUSED:
				ret = WEB_CONNREFUSED;
				break;
			case EHOSTDOWN:
				ret = WEB_HOSTDOWN;
				break;
			default:
				/* some other fatal error */
				ret = WEB_NOCONNECT;
				if (libhttperr == NULL) {
					pkgerr_add(err, PKGERR_WEB,
					    gettext(ERR_INIT_CONN),
					    ps->url.hport.hostname);
				} else {
					pkgerr_add(err, PKGERR_WEB,
					    gettext(ERR_HTTP), libhttperr);
				}
				break;
			}
			goto cleanup;
		}
		if ((n = write(fd, ps->content, n)) == 0) {
			pkgerr_add(err, PKGERR_WEB, gettext(ERR_WRITE),
			    ps->uniqfile, strerror(errno));
			ret = WEB_GET_FAIL;
			goto cleanup;
		}
		ps->data.cur_pos += n;
		abs_pos += n;
	}

	progress_finish(nointeract);
	echo_out(nointeract, gettext(MSG_DWNLD_COMPLETE));

	if (!make_link(dwnld_dir, bname)) {
		pkgerr_add(err, PKGERR_WEB, gettext(MSG_NOTEMP),
		    dwnld_dir);
		ret = WEB_GET_FAIL;
		goto cleanup;
	}

cleanup:
	sync();
	if (fd != -1) {
		(void) close(fd);
	}

	if (head_val != NULL)
		free(head_val);

	if (lastmod_val != NULL)
		free(lastmod_val);

	return (ret);
}

/*
 * Name:		make_link
 * Description:	Create new link to file being downloaded
 *
 * Arguments:	dwnld_dir - directory in which downloaded file exists
 *		bname - name of link
 *
 * Returns :	B_TRUE - success, B_FALSE otherwise
 */
static boolean_t
make_link(char *dwnld_dir, char *bname)
{
	int len;

	if ((ps->link = (char *)xmalloc(PATH_MAX)) == NULL)
		return (B_FALSE);
	if (((len = snprintf(ps->link, PATH_MAX, "%s/%s",
	    dwnld_dir, bname)) < 0) ||
	    len >= PATH_MAX)
		return (B_FALSE);

	(void) link(ps->uniqfile, ps->link);

	return (B_TRUE);
}

/*
 * Name:		get_startof_string
 * Description:	searches string for token, returns a newly-allocated
 *		substring of the given string up to, but not
 *		including, token.  for example
 *		get_startof_string("abcd", 'c') will return "ab"
 *
 * Arguments:	path - path to split
 *     		token - character to split on
 *
 * Returns :	substring of 'path', up to, but not including,
 *		token, if token appears in path.  Otherwise,
 *		returns NULL.
 */
char *
get_startof_string(char *path, char token)
{
	char *p, *p2;

	if (path == NULL)
		return (NULL);

	p = xstrdup(path);

	p2 = strchr(p, token);
	if (p2 == NULL) {
		free(p);
		return (NULL);
	} else {
		*p2 = '\0';
		return (p);
	}
}

/*
 * Name:		get_endof_string
 * Description:	searches string for token, returns a
 *		newly-allocated substring of the given string,
 *		starting at character following token, to end of
 *		string.
 *
 *		for example get_end_string("abcd", 'c')
 *		will return "d"
 *
 * Arguments:	path - path to split
 *     		token - character to split on
 *
 * Returns :	substring of 'path', beginning at character
 *		following token, to end of string, if
 *		token appears in path.  Otherwise,
 * returns NULL.
 */
char *
get_endof_string(char *path, char token)
{
	char *p, *p2;

	if (path == NULL)
		return (NULL);

	p = xstrdup(path);

	if ((p2 = strrchr(p, token)) == NULL) {
		return (NULL);
	}

	return (p2 + 1);
}

/*
 * Name:		progress_setup
 * Description:	Initialize session for reporting progress
 *
 * Arguments:	nointeract - if non-zero, do not do anything
 *		ulong_t - size of job to report progress for
 *
 * Returns :	none
 */
static void
progress_setup(int nointeract, ulong_t size_of_load)
{
	ulong_t divisor;
	ulong_t term_width = TERM_WIDTH;

	if (nointeract)
		return;

	if (size_of_load > MED_DWNLD && size_of_load < LARGE_DWNLD)
		divisor = MED_DIVISOR;
	else if (size_of_load > LARGE_DWNLD) {
		term_width = TERM_WIDTH - 8;
		divisor = LARGE_DIVISOR;
	} else
		divisor = SMALL_DIVISOR;

	const_increment = size_of_load / term_width;
	const_divider = size_of_load / divisor;
	const_completed = 100 / divisor;
}

/*
 * Name:		progress_report
 * Description:	Report progress for current progress context,
 *		to stderr
 *
 * Arguments:	nointeract - if non-zero, do not do anything
 *		position - how far along in the job to report.
 *		This should be <= size used during progress_setup
 *
 * Returns :	none
 */
static void
progress_report(int nointeract, ulong_t position)
{
	static ulong_t increment;
	static ulong_t divider;

	if (nointeract)
		return;

	if (position == 0) {
		increment = const_increment;
		divider = const_divider;
	}
	if (position > increment && position < divider) {
		(void) putc('.', stderr);
		increment += const_increment;
	} else if (position > divider) {
		completed += const_completed;
		(void) fprintf(stderr, "%ld%c", completed, '%');
		increment += const_increment;
		divider += const_divider;
	}
}

/*
 * Name:		progress_finish
 * Description:	Finalize session for reporting progress.
 *		"100%" is reported to screen
 *
 * Arguments:	nointeract - if non-zero, do not do anything
 *
 * Returns :	none
 */
static void
progress_finish(int nointeract)
{
	if (nointeract)
		return;

	(void) fprintf(stderr, "%d%c\n", 100, '%');
}

/*
 * Name:		init_session
 * Description:	Initializes static 'ps' structure with default
 *		values
 *
 * Arguments:	none
 *
 * Returns :	B_TRUE - success, B_FALSE otherwise
 */
static boolean_t
init_session(void)
{
	if ((ps = (WEB_SESSION *)
		xmalloc(sizeof (WEB_SESSION))) == NULL) {
		return (B_FALSE);
	}
	(void) memset(ps, 0, sizeof (*ps));

	if ((ps->content = (char *)xmalloc(BLOCK)) == NULL) {
		return (B_FALSE);
	}

	(void) memset(ps->content, 0, BLOCK);

	ps->data.cur_pos = 0UL;
	ps->data.content_length = 0UL;
	ps->url.https = B_FALSE;
	ps->uniqfile = NULL;
	ps->link = NULL;
	ps->dwnld_dir = NULL;
	ps->spool = B_TRUE;
	ps->errstr = NULL;
	ps->keystore = NULL;

	return (B_TRUE);
}

/*
 * Name:		ck_downld_dir_space
 * Description:	Verify enough space exists in directory to hold file
 *
 * Arguments:	err - where to record any errors.
 *     		dwnld_dir - Directory to check available space in
 *		bytes_needed - How many bytes are need
 *
 * Returns :	B_TRUE - enough space exists in dwnld_dir to hold
 *		bytes_needed bytes, otherwise B_FALSE
 */
static boolean_t
ck_dwnld_dir_space(PKG_ERR *err, char *dwnld_dir, ulong_t bytes_needed)
{
	u_longlong_t bytes_avail;
	u_longlong_t block_pad;
	struct statvfs64 status;

	if (statvfs64(dwnld_dir, &status)) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_TMPDIR), dwnld_dir);
		return (B_FALSE);
	}

	block_pad = (status.f_frsize ? status.f_frsize : status.f_bsize);
	bytes_avail = status.f_bavail * block_pad;

	if ((((u_longlong_t)bytes_needed) + block_pad) > bytes_avail) {
		pkgerr_add(err, PKGERR_WEB, gettext(ERR_DISK_SPACE),
		    dwnld_dir,
		    (((u_longlong_t)bytes_needed) + block_pad) / 1024ULL,
		    bytes_avail / 1024ULL);
		return (B_FALSE);
	}

	return (B_TRUE);
}

/*
 * Description:
 *    This function returns a unique file name based on the parts of the
 *    URI. This is done to enable partially downloaded files to be resumed.
 * Arguments:
 *    dir - The directory that should contain the filename.
 *    last_modified - A string representing the date of last modification,
 *	used as part of generating unique name
 * Returns:
 *    A valid filename or NULL.
 */

static char *
get_unique_filename(char *dir, char *last_modified)
{
	char *buf, *buf2, *beg_str;
	int len;

	if ((buf = (char *)xmalloc(PATH_MAX)) == NULL) {
		return (NULL);
	}
	if ((buf2 = (char *)xmalloc(PATH_MAX)) == NULL) {
		return (NULL);
	}

	/* prepare strings for being cat'ed onto */
	buf[0] = buf2[0] = '\0';
	/*
	 * No validation of the path is done here. We just construct the path
	 * and it must be validated later
	 */

	if (dir) {
		if (((len = snprintf(buf2, PATH_MAX, "%s/", dir)) < 0) ||
		    (len >= PATH_MAX))
			return (NULL);
	} else {
		return (NULL);
	}

	if (ps->url.abspath)
		if (strlcat(buf, ps->url.abspath, PATH_MAX) >= PATH_MAX)
			return (NULL);
	if (ps->url.hport.hostname)
		if (isdigit((int)ps->url.hport.hostname[0])) {
			if (strlcat(buf, ps->url.hport.hostname, PATH_MAX)
					>= PATH_MAX)
				return (NULL);
		} else {
			if ((beg_str =
				get_startof_string(ps->url.hport.hostname, '.'))
					!= NULL)
				if (strlcat(buf, beg_str, PATH_MAX) >= PATH_MAX)
					return (NULL);
		}
	if (last_modified != NULL)
		if (strlcat(buf, last_modified, PATH_MAX) >= PATH_MAX)
			return (NULL);

	if ((buf = replace_token(buf, '/', '_')) != NULL) {
		if (strlcat(buf2, buf, PATH_MAX) >= PATH_MAX) {
			return (NULL);
		} else {
			if (buf) free(buf);
			return (buf2);
		}
	} else {
		if (buf) free(buf);
		if (buf2) free(buf2);
		return (NULL);
	}
}

/*
 * Description:
 *    Removes token(s) consisting of one character from any path.
 * Arguments:
 *    path  - The path to search for the token in.
 *    token - The token to search for
 * Returns:
 *    The path with all tokens removed or NULL.
 */
static char *
replace_token(char *path, char oldtoken, char newtoken)
{
	char *newpath, *p;

	if ((path == NULL) || (oldtoken == '\0') || (newtoken == '\0')) {
		return (NULL);
	}

	newpath = xstrdup(path);

	for (p = newpath; *p != '\0'; p++) {
		if (*p == oldtoken) {
			*p = newtoken;
		}
	}

	return (newpath);
}

/*
 * Name:        trim
 * Description: Trims whitespace from a string
 *              has been registered)
 * Scope:       private
 * Arguments:   string  - string to trim.  It is assumed
 *              this string is writable up to it's entire
 *              length.
 * Returns:     none
 */
static void
trim(char *str)
{
	int len, i;
	if (str == NULL) {
		return;
	}

	len = strlen(str);
	/* strip from front */
	while (isspace(*str)) {
		for (i = 0; i < len; i++) {
			str[i] = str[i+1];
		}
	}

	/* strip from back */
	len = strlen(str);
	while (isspace(str[len-1])) {
		len--;
	}
	str[len] = '\0';
}

/*
 * Description:
 *    Resolves double quotes
 * Arguments:
 *    str  - The string to resolve
 * Returns:
 *    None
 */
static void
dequote(char *str)
{
	char *cp;

	if ((str == NULL) || (str[0] != '"')) {
		/* no quotes */
		return;
	}

	/* remove first quote */
	(void) memmove(str, str + 1, strlen(str) - 1);

	/*
	 * scan string looking for ending quote.
	 * escaped quotes like \" don't count
	 */
	cp = str;

	while (*cp != '\0') {
		switch (*cp) {
		case '\\':
			/* found an escaped character */
			/* make sure end of string is not '\' */
			if (*++cp != '\0') {
				cp++;
			}
			break;

		case '"':
			*cp = '\0';
			break;
		default:
			cp++;
		}
	}
}

/*
 * Name:		get_ENV_proxy
 * Description:	Retrieves setting of proxy env variable
 *
 * Arguments:	err - where to record any errors.
 *		proxy - where to store proxy
 *
 * Returns :	B_TRUE - http proxy was found and valid, stored in proxy
 *		B_FALSE - error, errors recorded in err
 */
static boolean_t
get_ENV_proxy(PKG_ERR *err, char **proxy)
{
	char *buf;

	if ((buf = getenv("HTTPPROXY")) != NULL) {
		if (!path_valid(buf)) {
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_ILL_ENV), "HTTPPROXY", buf);
			return (B_FALSE);
		} else {
			*proxy = buf;
			return (B_TRUE);
		}
	} else {
		/* try the other env variable */
		if ((buf = getenv("http_proxy")) != NULL) {
			if (!path_valid(buf)) {
				pkgerr_add(err, PKGERR_WEB,
				    gettext(ERR_ILL_ENV), "http_proxy", buf);
				return (B_FALSE);
			}
			if (!strneq(buf, "http://", 7)) {
				pkgerr_add(err, PKGERR_WEB,
				    gettext(ERR_ILL_ENV), "http_proxy", buf);
				return (B_FALSE);
			}

			/* skip over the http:// part of the proxy "url" */
			    *proxy = buf + 7;
			    return (B_TRUE);
		}
	}

	/* either the env variable(s) were set and valid, or not set */
	return (B_TRUE);
}

/*
 * Name:		get_ENV_proxyport
 * Description:	Retrieves setting of PROXYPORT env variable
 *
 * Arguments:	err - where to record any errors.
 *		port - where to store resulting port
 *
 * Returns :	B_TRUE - string found in PROXYPORT variable, converted
 *		to decimal integer, if it exists
 *		and is valid.  Or, PROXYPORT not set, port set to 1.
 *		B_FALSE - env variable set, but invalid
 *			(not a number for example)
 */
static boolean_t
get_ENV_proxyport(PKG_ERR *err, ushort_t *port)
{
	char *buf;
	ushort_t	newport;
	buf = getenv("HTTPPROXYPORT");
	if (buf != NULL) {
		if (!path_valid(buf)) {
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_ILL_ENV), "HTTPPROXYPORT", buf);
			return (B_FALSE);
		}
		if ((newport = atoi(buf)) == 0) {
			pkgerr_add(err, PKGERR_WEB,
			    gettext(ERR_ILL_ENV), "HTTPPROXYPORT", buf);
			return (B_FALSE);
		}
		*port = newport;
		return (B_TRUE);
	} else {
		*port = 1;
		return (B_TRUE);
	}
}

/*
 * Name:		remove_dwnld_file
 * Description:	Removes newly-downloaded file if completely downloaded.
 *
 * Arguments:	path - path to file to remove
 *
 * Returns :	B_TRUE - success, B_FALSE otherwise
 *		if it's '0' (not OK) we simply return it, since the
 *		verification operation has already determined that the
 *		cert is invalid.  if 'ok' is non-zero, then we do our
 *		checks, and return 0 or 1 based on if the cert is
 *		invalid or valid.
 */
static boolean_t
remove_dwnld_file(char *path)
{
	if (path && path != NULL) {
		/*
		 * Only remove the downloaded file if it has been completely
		 * downloaded, or is not eligible for spooling
		 */
		if ((!ps->spool) ||
		    (ps->data.cur_pos  >= ps->data.content_length)) {
			(void) unlink(path);
		}
	} else {
		return (B_FALSE);
	}
	return (B_TRUE);
}

/*
 * Name:		condense_lastmodifided
 * Description:	generates a substring of a last-modified string,
 *		and removes colons.
 *
 * Arguments:	last_modified - string of the form
 *		"Wed, 23 Oct 2002 21:59:45 GMT"
 *
 * Returns :
 *		new string, consisting of hours/minutes/seconds only,
 *		sans any colons.
 */
char *
condense_lastmodified(char *last_modified)
{
	char *p, *p2;

	/*
	 * Last-Modified: Wed, 23 Oct 2002 21:59:45 GMT
	 * Strip the hours, minutes and seconds, without the ':'s, from
	 * the above string, void of the ':".
	 */

	if (last_modified == NULL)
		return (NULL);

	if ((p = xstrdup(last_modified)) == NULL)
		return (NULL);
	p2 = (strstr(p, ":") - 2);
	p2[8] = '\0';
	return (replace_token(p2, ':', '_'));
}

/*
 * Name:		backoff
 * Description:	sleeps for a certain # of seconds after a network
 *		failure.
 * Scope:	public
 * Arguments:	none
 * Returns:	none
 */
void
backoff()
{
	static boolean_t initted = B_FALSE;
	int backoff;
	long seed;

	if (!initted) {
		/* seed the rng */
		(void) _get_random_info(&seed, sizeof (seed));
		srand48(seed);
		initted = B_TRUE;
	}

	backoff = (int)(drand48() * (double)cur_backoff);
	(void) sleep(backoff);
	if (cur_backoff < MAX_BACKOFF) {
		/*
		 * increase maximum time we might wait
		 * next time so as to fall off over
		 * time.
		 */
		cur_backoff *= BACKOFF_FACTOR;
	}
}

/*
 * Name:		reset_backoff
 * Description:	notifies the backoff service that whatever was
 *		being backoff succeeded.
 * Scope:	public
 * Arguments:	none
 * Returns:	none
 */
void
reset_backoff()
{
	cur_backoff = MIN_BACKOFF;
}

/*
 * Name:	_get_random_info
 * Description:	generate an amount of random bits.  Currently
 *		only a small amount (a long long) can be
 *		generated at one time.
 * Scope:	private
 * Arguments:	buf	- [RO, *RW] (char *)
 *			  Buffer to copy bits into
 *		size	- amount to copy
 * Returns:	B_TRUE on success, B_FALSE otherwise.  The buffer is filled
 *		with the amount of bytes of random data specified.
 */
static boolean_t
_get_random_info(void *buf, int size)
{
	struct timeval tv;
	typedef struct {
		long low_time;
		long hostid;
	} randomness;
	randomness r;

	/* if the RANDOM file exists, use it */
	if (access(RANDOM, R_OK) == 0) {
		if ((RAND_load_file(RANDOM, 1024 * 1024)) > 0) {
			if (RAND_bytes((uchar_t *)buf, size) == 1) {
				/* success */
				return (B_TRUE);
			}
		}
	}

	/* couldn't use RANDOM file, so fallback to time of day and hostid */
	(void) gettimeofday(&tv, (struct timezone *)0);

	/* Wouldn't it be nice if we could hash these */
	r.low_time = tv.tv_usec;
	r.hostid = gethostid();

	if (sizeof (r) < size) {
		/*
		 * Can't copy correctly
		 */
		return (B_FALSE);
	}
	(void) memcpy(buf, &r, size);
	return (B_TRUE);
}

/*
 * Name:		pkg_passphrase_cb
 * Description:	Default callback that applications can use when
 *		a passphrase is needed.  This routine collects
 *		a passphrase from the user using the given
 *		passphrase retrieval method set with
 *		set_passphrase_passarg().  If the method
 *		indicates an interactive prompt, then the
 *		prompt set with set_passphrase_prompt()
 *		is displayed.
 *
 * Arguments:	buf	- Buffer to copy passphrase into
 *		size	- Max amount to copy to buf
 *		rw	- Whether this passphrase is needed
 *			to read something off disk, or
 *			write something to disk.  Applications
 *			typically want to ask twice when getting
 *			a passphrase for writing something.
 *		data	- application-specific data.  In this
 *			callback, data is a pointer to
 *			a keystore_passphrase_data structure.
 *
 * Returns:	Length of passphrase collected, or -1 on error.
 *		Errors recorded in 'err' object in the *data.
 */
int
pkg_passphrase_cb(char *buf, int size, int rw, void *data)
{
	BIO		*pwdbio = NULL;
	char		passphrase_copy[MAX_PHRASELEN + 1];
	PKG_ERR		*err;
	int		passlen;
	char		*ws;
	char		prompt_copy[MAX_VERIFY_MSGLEN];
	char		*passphrase;
	char		*arg;

	err = ((keystore_passphrase_data *)data)->err;

	if (passarg == NULL) {
		arg = "console";
	} else {
		arg = passarg;
	}

	/* default method of collecting password is by prompting */
	if (ci_streq(arg, "console")) {
		if ((passphrase = getpassphrase(prompt)) == NULL) {
			pkgerr_add(err, PKGERR_BADPASS,
			    gettext(MSG_NOPASS), arg);
			return (-1);
		}

		if (rw) {
			/*
			 * if the password is being supplied for
			 * writing something to disk, verify it first
			 */

			/* make a copy (getpassphrase overwrites) */
			(void) strlcpy(passphrase_copy, passphrase,
			    MAX_PHRASELEN + 1);

			if (((passlen = snprintf(prompt_copy,
					MAX_VERIFY_MSGLEN, "%s: %s",
					gettext(MSG_PASSWD_AGAIN),
					prompt)) < 0) ||
			    (passlen >= (MAX_PHRASELEN + 1))) {
				pkgerr_add(err, PKGERR_BADPASS,
				    gettext(MSG_NOPASS), arg);
				return (-1);
			}

			if ((passphrase =
			    getpassphrase(prompt_copy)) == NULL) {
				pkgerr_add(err, PKGERR_BADPASS,
				    gettext(MSG_NOPASS), arg);
				return (-1);
			}

			if (!streq(passphrase_copy, passphrase)) {
				pkgerr_add(err, PKGERR_READ,
				    gettext(MSG_PASSWD_NOMATCH));
				return (-1);
			}
		}
	} else if (ci_strneq(arg, "pass:", 5)) {
		passphrase = arg + 5;
	} else if (ci_strneq(arg, "env:", 4)) {
		passphrase = getenv(arg + 4);
	} else if (ci_strneq(arg, "file:", 5)) {

		/* open file for reading */
		if ((pwdbio = BIO_new_file(arg + 5, "r")) == NULL) {
			pkgerr_add(err, PKGERR_EXIST,
			    gettext(MSG_PASSWD_FILE), arg + 5);
			return (-1);
		}

		/* read first line */
		if (((passlen = BIO_gets(pwdbio, buf, size)) < 1) ||
		    (passlen > size)) {
			pkgerr_add(err, PKGERR_READ, gettext(MSG_PASSWD_FILE),
			    arg + 5);
			return (-1);
		}
		BIO_free_all(pwdbio);
		pwdbio = NULL;

		if (passlen == size) {
			/*
			 * password was maximum length, so there is
			 * no null terminator. null-terminate it
			 */
			buf[size - 1] = '\0';
		}

		/* first newline found is end of passwd, so nuke it */
		if ((ws = strchr(buf, '\n')) != NULL) {
			*ws = '\0';
		}
		return (strlen(buf));
	} else {
		/* unrecognized passphrase */
		pkgerr_add(err, PKGERR_BADPASS,
		    gettext(MSG_BADPASSARG), arg);
		return (-1);
	}

	if (passphrase == NULL) {
		/* unable to collect passwd from given source */
		pkgerr_add(err, PKGERR_BADPASS,
		    gettext(MSG_NOPASS), arg);
		return (-1);
	}

	(void) strlcpy(buf, passphrase, size);
	return (strlen(buf));
}