daemon/tls: document new behavior

diff --git a/modules/policy/README.rst b/modules/policy/README.rst
index 6ac242acc62fdbdd420071a8f3749d1769571f67..f635df9a2d8ff134267b0d1a779d3162c982f1c1 100644 (file)
--- a/modules/policy/README.rst
+++ b/modules/policy/README.rst
@@ -71,10 +71,11 @@ Traditional PKI authentication requires server to present certificate with speci
 .. code-block:: lua
 
         policy.TLS_FORWARD({
-                {'2001:DB8::d0c', hostname='res.example.com', ca_file='/etc/knot-resolver/tlsca.crt'}})
+                {'2001:DB8::d0c', hostname='res.example.com'}})
 
 - `hostname` must exactly match hostname in server's certificate, i.e. in most cases it must not contain trailing dot (`res.example.com`).
-- `ca_file` must be path to CA certificate (or certificate bundle) in `PEM format`_.
+- System CA certificate store will be used if no `ca_file` option is specified.
+- Optional `ca_file` option can specify path to CA certificate (or certificate bundle) in `PEM format`_.
 
 TLS Examples
 ~~~~~~~~~~~~
@@ -87,6 +88,8 @@ TLS Examples
        -- for brevity, other TLS examples omit policy.add(policy.all())
        -- single server authenticated using its certificate pin_sha256
          policy.TLS_FORWARD({{'192.0.2.1', pin_sha256='YQ=='}})  -- pin_sha256 is base64-encoded
+       -- single server authenticated using hostname and system-wide CA certificates
+         policy.TLS_FORWARD({{'192.0.2.1', hostname='res.example.com'}})
        -- single server using non-standard port
          policy.TLS_FORWARD({{'192.0.2.1@443', pin_sha256='YQ=='}})  -- use @ or # to specify port
        -- single server with multiple valid pins (e.g. anycast)

diff --git a/modules/policy/policy.test.lua b/modules/policy/policy.test.lua
index ccb3f5b6cb096e1f0d1465699a1e3a6ca09cd7c0..8780caa1e1dcbf4352db0feb7c41149337249225 100644 (file)
--- a/modules/policy/policy.test.lua
+++ b/modules/policy/policy.test.lua
@@ -39,7 +39,7 @@ local function test_tls_forward()
                }}}), 'TLS_FORWARD with table of pins')
 
        -- ok(policy.TLS_FORWARD({{'::1', hostname='test.', ca_file='/tmp/ca.crt'}}), 'TLS_FORWARD with hostname + CA cert')
-       -- boom(policy.TLS_FORWARD, {{{'::1', hostname='test.'}}}, 'TLS_FORWARD with just hostname')
+       ok(policy.TLS_FORWARD({{'::1', hostname='test.'}}), 'TLS_FORWARD with just hostname (use system CA store)')
        boom(policy.TLS_FORWARD, {{{'::1', ca_file='/tmp/ca.crt'}}}, 'TLS_FORWARD with just CA cert')
        boom(policy.TLS_FORWARD, {{{'::1', hostname='', ca_file='/tmp/ca.crt'}}}, 'TLS_FORWARD with empty hostname + CA cert')
        boom(policy.TLS_FORWARD, {{{'::1', hostname='test.', ca_file='/dev/a_file_which_surely_does_NOT_exist!'}}},