1 files changed, 219 insertions, 0 deletions

diff --git a/src/lib/libcrypto/man/X509_LOOKUP_hash_dir.3 b/src/lib/libcrypto/man/X509_LOOKUP_hash_dir.3
new file mode 100644
index 0000000000..4b06525994
--- /dev/null
+++ b/src/lib/libcrypto/man/X509_LOOKUP_hash_dir.3
@@ -0,0 +1,219 @@
+.\"     $OpenBSD: X509_LOOKUP_hash_dir.3,v 1.1 2016/12/04 20:51:47 schwarze Exp $
+.\"     OpenSSL 99d63d46 Oct 26 13:56:48 2016 -0400
+.\"
+.\" This file was written by Victor B. Wagner <vitus@cryptocom.ru>
+.\" and Claus Assmann.
+.\" Copyright (c) 2015, 2016 The OpenSSL Project.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\"
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\"
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in
+.\"    the documentation and/or other materials provided with the
+.\"    distribution.
+.\"
+.\" 3. All advertising materials mentioning features or use of this
+.\"    software must display the following acknowledgment:
+.\"    "This product includes software developed by the OpenSSL Project
+.\"    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+.\"
+.\" 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+.\"    endorse or promote products derived from this software without
+.\"    prior written permission. For written permission, please contact
+.\"    openssl-core@openssl.org.
+.\"
+.\" 5. Products derived from this software may not be called "OpenSSL"
+.\"    nor may "OpenSSL" appear in their names without prior written
+.\"    permission of the OpenSSL Project.
+.\"
+.\" 6. Redistributions of any form whatsoever must retain the following
+.\"    acknowledgment:
+.\"    "This product includes software developed by the OpenSSL Project
+.\"    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+.\" EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+.\" ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+.\" SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+.\" LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+.\" STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+.\" OF THE POSSIBILITY OF SUCH DAMAGE.
+.\"
+.Dd $Mdocdate: December 4 2016 $
+.Dt X509_LOOKUP_HASH_DIR 3
+.Os
+.Sh NAME
+.Nm X509_LOOKUP_hash_dir ,
+.Nm X509_LOOKUP_file ,
+.Nm X509_load_cert_file ,
+.Nm X509_load_crl_file ,
+.Nm X509_load_cert_crl_file
+.Nd default OpenSSL certificate lookup methods
+.Sh SYNOPSIS
+.In openssl/x509_vfy.h
+.Ft X509_LOOKUP_METHOD *
+.Fn X509_LOOKUP_hash_dir void
+.Ft X509_LOOKUP_METHOD *
+.Fn X509_LOOKUP_file void
+.Ft int
+.Fo X509_load_cert_file
+.Fa "X509_LOOKUP *ctx"
+.Fa "const char *file"
+.Fa "int type"
+.Fc
+.Ft int
+.Fo X509_load_crl_file
+.Fa "X509_LOOKUP *ctx"
+.Fa "const char *file"
+.Fa "int type"
+.Fc
+.Ft int
+.Fo X509_load_cert_crl_file
+.Fa "X509_LOOKUP *ctx"
+.Fa "const char *file"
+.Fa "int type"
+.Fc
+.Sh DESCRIPTION
+.Fn X509_LOOKUP_hash_dir
+and
+.Fn X509_LOOKUP_file
+are two certificate lookup methods to use with
+.Vt X509_STORE ,
+provided by OpenSSL library.
+.Pp
+Users of the library typically do not need to create instances of these
+methods manually.
+They are created automatically by the
+.Xr X509_STORE_load_locations 3
+or
+.Xr SSL_CTX_load_verify_locations 3
+functions.
+.Pp
+Internally loading of certificates and CRLs is implemented via functions
+.Fn X509_load_cert_crl_file ,
+.Fn X509_load_cert_file
+and
+.Fn X509_load_crl_file .
+These functions support a parameter
+.Fa type ,
+which can be one of the constants
+.Dv FILETYPE_PEM ,
+.Dv FILETYPE_ASN1 ,
+and
+.Dv FILETYPE_DEFAULT .
+They load certificates and/or CRLs from the specified file into a
+memory cache of
+.Vt X509_STORE
+objects which the given
+.Fa ctx
+parameter is associated with.
+.Pp
+The functions
+.Fn X509_load_cert_file
+and
+.Fn X509_load_crl_file
+can load both PEM and DER formats depending on the
+.Fa type
+value.
+Because DER format cannot contain more than one certificate or CRL
+object (while PEM can contain several concatenated PEM objects),
+.Fn X509_load_cert_crl_file
+with
+.Dv FILETYPE_ASN1
+is equivalent to
+.Fn X509_load_cert_file .
+.Pp
+The constant
+.Dv FILETYPE_DEFAULT
+with
+.Dv NULL
+filename causes these functions to load default certificate
+store file (see
+.Xr X509_STORE_set_default_paths 3 ) .
+.Pp
+These functions return the number of objects loaded from file or 0
+in case of error.
+.Pp
+Both methods support adding several certificate locations into one
+.Sy X509_STORE .
+.Pp
+This page documents certificate store formats used by these methods and
+caching policy.
+.Ss File Method
+The
+.Fn X509_LOOKUP_file
+method loads all the certificates or CRLs present in a file into memory
+at the time the file is added as a lookup source.
+.Pp
+The file format is ASCII text which contains concatenated PEM
+certificates and CRLs.
+.Pp
+This method should be used by applications which work with a small set
+of CAs.
+.Ss Hashed Directory Method
+.Fa X509_LOOKUP_hash_dir
+is a more advanced method, which loads certificates and CRLs on demand,
+and caches them in memory once they are loaded.
+As of OpenSSL 1.0.0, it also checks for newer CRLs upon each lookup, so
+that newer CRLs are used as soon as they appear in the directory.
+.Pp
+The directory should contain one certificate or CRL per file in PEM
+format, with a file name of the form
+.Ar hash . Ns Ar N
+for a certificate, or
+.Ar hash . Ns Sy r Ns Ar N
+for a CRL.
+The
+.Ar hash
+is the value returned by the
+.Xr X509_NAME_hash 3
+function applied to the subject name for certificates or issuer
+name for CRLs.
+The hash can also be obtained via the
+.Fl hash
+option of the
+.Xr openssl
+.Cm x509
+or
+.Cm crl
+commands.
+.Pp
+The
+.Ar N
+suffix is a sequence number that starts at zero and is incremented
+consecutively for each certificate or CRL with the same
+.Ar hash
+value.
+Gaps in the sequence numbers are not supported.
+It is assumed that there are no more objects with the same hash
+beyond the first missing number in the sequence.
+.Pp
+Sequence numbers make it possible for the directory to contain multiple
+certificates with the same subject name hash value.
+For example, it is possible to have in the store several certificates
+with the same subject or several CRLs with the same issuer (and, for
+example, a different validity period).
+.Pp
+When checking for new CRLs, once one CRL for a given hash value is
+loaded, hash_dir lookup method checks only for certificates with
+sequence number greater than that of the already cached CRL.
+.Pp
+Note that the hash algorithm used for subject name hashing changed in
+OpenSSL 1.0.0, and all certificate stores have to be rehashed when
+moving from OpenSSL 0.9.8 to 1.0.0.
+.Sh SEE ALSO
+.Xr d2i_X509_bio 3 ,
+.Xr PEM_read_PrivateKey 3 ,
+.Xr SSL_CTX_load_verify_locations 3 ,
+.Xr X509_STORE_add_lookup 3 ,
+.Xr X509_STORE_load_locations 3