TLS: use RFC 6125 rules for certifucate name checks when CNAMES are present. Bug...

[users/jgh/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index e5a3c4be80d340bed640e382d4a245ea8efc37d8..e3684ba308ed8060b4192bd6ccf36ba878a02fe5 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -9472,7 +9472,7 @@ Common ways of obtaining untainted equivalents of variables with
 tainted values
 .cindex "tainted data" "de-tainting"
 come down to using the tainted value as a lookup key in a trusted database.
 tainted values
 .cindex "tainted data" "de-tainting"
 come down to using the tainted value as a lookup key in a trusted database.

-This database could be the filestem structure,
+This database could be the filesystem structure,

 or the password file,
 or accessed via a DBMS.
 Specific methods are indexed under &"de-tainting"&.
 or the password file,
 or accessed via a DBMS.
 Specific methods are indexed under &"de-tainting"&.


@@ -10201,7 +10201,7 @@ in a list using the given separator.
 .wen
 
 
 .wen
 
 

-.vitem "&*${lookup{*&<&'key'&>&*}&~*&<&'search&~type'&>&*&~&&&
+.vitem "&*${lookup&~{*&<&'key'&>&*}&~*&<&'search&~type'&>&*&~&&&

         {*&<&'file'&>&*}&~{*&<&'string1'&>&*}&~{*&<&'string2'&>&*}}*&" &&&
        "&*${lookup&~*&<&'search&~type'&>&*&~{*&<&'query'&>&*}&~&&&
         {*&<&'string1'&>&*}&~{*&<&'string2'&>&*}}*&"
         {*&<&'file'&>&*}&~{*&<&'string1'&>&*}&~{*&<&'string2'&>&*}}*&" &&&
        "&*${lookup&~*&<&'search&~type'&>&*&~{*&<&'query'&>&*}&~&&&
         {*&<&'string1'&>&*}&~{*&<&'string2'&>&*}}*&"


@@ -12473,7 +12473,7 @@ the complete argument of the ETRN command (see section &<<SECTETRN>>&).
 .cindex "tainted data"
 If the origin of the data is an incoming message,
 the result of expanding this variable is tainted.
 .cindex "tainted data"
 If the origin of the data is an incoming message,
 the result of expanding this variable is tainted.

-When un untainted version is needed, one should be obtained from
+When in untainted version is needed, one should be obtained from

 looking up the value in a local (therefore trusted) database.
 Often &$domain_data$& is usable in this role.
 
 looking up the value in a local (therefore trusted) database.
 Often &$domain_data$& is usable in this role.
 


@@ -29242,8 +29242,14 @@ certificate verification to the listed servers.  Verification either must
 or need not succeed respectively.
 
 The &%tls_verify_cert_hostnames%& option lists hosts for which additional
 or need not succeed respectively.
 
 The &%tls_verify_cert_hostnames%& option lists hosts for which additional

-checks are made: that the host name (the one in the DNS A record)
-is valid for the certificate.
+name checks are made on the server certificate.
+.new
+The match against this list is, as per other Exim usage, the
+IP for the host.  That is most closely associated with the
+name on the DNS A (or AAAA) record for the host.
+However, the name that needs to be in the certificate
+is the one at the head of any CNAME chain leading to the A record.
+.wen

 The option defaults to always checking.
 
 The &(smtp)& transport has two OCSP-related options:
 The option defaults to always checking.
 
 The &(smtp)& transport has two OCSP-related options: