Doc: Add hint about spamd and half-closed connections

[user/henk/code/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 45d84571869afdeda6b21ff033d6d85639d5e9e4..c3fc1fb2145204e14f89aa04253276aa15980710 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -5044,7 +5044,7 @@ They can be used to conditionally include parts of a configuration
 The following classes of macros are defined:
 .display
 &` _HAVE_                     `&  build-time defines
-&` _DRVR_AUTH_                `&  authehticator drivers
+&` _DRVR_AUTH_                `&  authenticator drivers
 &` _DRVR_RTR_                 `&  router drivers
 &` _DRVR_TPT_                 `&  transport drivers
 &` _OPT_                      `&  configuration option support
@@ -13593,6 +13593,7 @@ listed in more than one group.
 .row &%slow_lookup_log%&             "control logging of slow DNS lookups"
 .row &%syslog_duplication%&          "controls duplicate log lines on syslog"
 .row &%syslog_facility%&             "set syslog &""facility""& field"
+.row &%syslog_pid%&                  "pid in syslog lines"
 .row &%syslog_processname%&          "set syslog &""ident""& field"
 .row &%syslog_timestamp%&            "timestamp syslog lines"
 .row &%write_rejectlog%&             "control use of message log"
@@ -16856,6 +16857,15 @@ If this option is unset, &"mail"& is used. See chapter &<<CHAPlog>>& for
 details of Exim's logging.
 
 
+.option syslog_pid main boolean true
+.cindex "syslog" "pid"
+If &%syslog_pid%& is set false, the PID on Exim's log lines are
+omitted when these lines are sent to syslog. (Syslog normally prefixes
+the log lines with the PID of the logging process automatically.) You need
+to enable the &`+pid`& log selector item, if you want Exim to write it's PID
+into the logs.) See chapter &<<CHAPlog>>& for details of Exim's logging.
+
+
 
 .option syslog_processname main string &`exim`&
 .cindex "syslog" "process name; setting"
@@ -23986,11 +23996,30 @@ unauthenticated. See also &%hosts_require_auth%&, and chapter
 .cindex CHUNKING "enabling, in client"
 .cindex BDAT "SMTP command"
 .cindex "RFC 3030" "CHUNKING"
-This option provides a list of server to which, provided they announce
+This option provides a list of servers to which, provided they announce
 CHUNKING support, Exim will attempt to use BDAT commands rather than DATA.
 BDAT will not be used in conjuction with a transport filter.
 .wen
 
+.new
+.option hosts_try_fastopen smtp "host list!!" unset
+.option "fast open, TCP" "enabling, in client"
+.option "TCP Fast Open" "enabling, in client"
+.option "RFC 7413" "TCP Fast Open"
+This option provides a list of servers to which, provided
+the facility is supported by this system, Exim will attempt to
+perform a TCP Fast Open.
+No data is sent on the SYN segment but, if the remote server also
+supports the facility, it can send its SMTP banner immediately after
+the SYN,ACK segment.  This can save up to one round-trip time.
+
+The facility is only active for previously-contacted servers,
+as the initiator must present a cookie in the SYN segment.
+
+On (at least some) current Linux distributions the facility must be enabled
+in the kernel by the sysadmin before the support is usable.
+.wen
+
 .option hosts_try_prdr smtp "host list&!!" *
 .cindex "PRDR" "enabling, optional in client"
 This option provides a list of servers to which, provided they announce
@@ -31639,6 +31668,15 @@ configuration as follows (example):
 .code
 spamd_address = 192.168.99.45 387
 .endd
+The SpamAssassin protocol relies on a TCP half-close from the client.
+If your SpamAssassin client side is running a Linux system with an
+iptables firewall, consider setting
+&%net.netfilter.nf_conntrack_tcp_timeout_close_wait%& to at least the
+timeout, Exim uses when waiting for a response from the SpamAssassin
+server (currently defaulting to 120s).  With a lower value the Linux
+connection tracking may consider your half-closed connection as dead too
+soon.
+
 
 To use Rspamd (which by default listens on all local addresses
 on TCP port 11333)