Document that tls_checkpeer results in a DNS lookup of the IP address.

Author: millert

docs/sudo_logsrvd.conf.man.in

@@ -2,7 +2,7 @@
 .\"
 .\" SPDX-License-Identifier: ISC
 .\"
-.\" Copyright (c) 2019-2023 Todd C. Miller <[email protected]>
+.\" Copyright (c) 2019-2025 Todd C. Miller <[email protected]>
 .\"
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -16,7 +16,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.TH "SUDO_LOGSRVD.CONF" "@mansectform@" "March 9, 2024" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
+.TH "SUDO_LOGSRVD.CONF" "@mansectform@" "September 28, 2025" "Sudo @PACKAGE_VERSION@" "File Formats Manual"
 .nh
 .if n .ad l
 .SH "NAME"
@@ -203,6 +203,11 @@ authority, the
 \fItls_cacert\fR
 setting must be set to a CA bundle that contains the CA certificate
 used to generate the client certificate.
+To validate the certificate,
+\fBsudo_logsrvd\fR
+will perform a reverse DNS lookup of the client's IP address.
+In order to be considered valid, either the IP address or the
+resolved hostname must be present in the client certificate.
 The default value is
 \fIfalse\fR.
 .TP 6n

docs/sudo_logsrvd.conf.mdoc.in

@@ -1,7 +1,7 @@
 .\"
 .\" SPDX-License-Identifier: ISC
 .\"
-.\" Copyright (c) 2019-2023 Todd C. Miller <[email protected]>
+.\" Copyright (c) 2019-2025 Todd C. Miller <[email protected]>
 .\"
 .\" Permission to use, copy, modify, and distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -15,7 +15,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd March 9, 2024
+.Dd September 28, 2025
 .Dt SUDO_LOGSRVD.CONF @mansectform@
 .Os Sudo @PACKAGE_VERSION@
 .Sh NAME
@@ -183,6 +183,11 @@ authority, the
 .Em tls_cacert
 setting must be set to a CA bundle that contains the CA certificate
 used to generate the client certificate.
+To validate the certificate,
+.Nm sudo_logsrvd
+will perform a reverse DNS lookup of the client's IP address.
+In order to be considered valid, either the IP address or the
+resolved hostname must be present in the client certificate.
 The default value is
 .Em false .
 .It tls_ciphers_v12 = string