The following patch adds OCSP checking to globus_i_gsi_callback_check_revoked()
called by globus_gsi_callback_handshake_callback().  It uses OpenSSL's OCSP
support.  If a certificate contains an OCSP URI in the AuthorityInfoAccess
extension, the OCSP responder is queried for certificate status.  Errors
obtaining/validating the OCSP response are ignored.  Only a valid OCSP Revoked
response will cause certificate verification failure.  CRL checking is still
performed in any case.

The code is based on two BSD-licensed software modules from the Secure
Programming Cookbook for C and C++ by John Viega and Matt Messier
(http://www.secureprogramming.com/) and X.509 certificate support for OpenSSH
by Roumen Petrov (http://roumenpetrov.info/openssh/).

The code currently sends unsigned certificate requests.  (The code to sign the
requests if #ifdef'ed out.)  Both http and https URIs are supported.  The use
of OCSP nonces is disabled per the recommendation of [GridOCSP].  However, none
of the configurability discussed in [GridOCSP] is implemented.

I've tested using 'grid-proxy-init -debug -verify' against both an OpenSSL OCSP
responder and the CertiVeR IGTF responder [IGTF].  Set
$GLOBUS_OCSP_DEBUG_LEVEL=2 for debugging output.

I ran the OpenSSL OCSP responder like this:

$ openssl ocsp -index ~/.globus/simpleCA/index.txt \
      -port 8888 -rsigner ~/.globus/simpleCA/cacert.pem \
      -rkey ~/.globus/simpleCA/private/cakey.pem \
      -CA ~/.globus/simpleCA/cacert.pem -text -out ocsp.log

The code could use some more work.  Perhaps it should be a separate GPT
package.  The current API is very simplistic, and there aren't good error
messages.  It could certainly be much more configurable.  Still, perhaps this
is a useful first step in having OCSP support in the Globus C code, as OGRO
provides support for the Java code.

Perhaps we can discuss it on the csec-dev@globus.org list
(http://www.globus.org/mail_archive/csec-dev/2006/10/msg00001.html).

References:
[GridOCSP] OCSP Requirements for Grids. 
https://forge.gridforum.org/sf/go/doc4852
[OCSP] PKIX Online Certifiacte Status Protocol.
http://www.ietf.org/rfc/rfc2560.txt
[OGRO] The Open GRid Ocsp Java client API
http://globus-grid.certiver.com/info/ogro/
[IGTF] CertiVeR IGTF OCSP Responder http://tacar.certiver.com/info/
[OpenValidation.Org] http://www.openvalidation.org/