TLS: Fix handling for server cert/key file SNI re-expansion forced-fail

[user/henk/code/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 865742bc3ad071bb788507f7c70d16e04bdb33c5..cd9259612c67302f2ce0bdc731cfd9bc4bdeda17 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -5103,6 +5103,10 @@ The following classes of macros are defined:
 &` _DRIVER_ROUTER_*           `&  router drivers
 &` _DRIVER_TRANSPORT_*        `&  transport drivers
 &` _DRIVER_AUTHENTICATOR_*    `&  authenticator drivers
+&` _EXP_COND_*                `&  expansion conditions
+&` _EXP_ITEM_*                `&  expansion items
+&` _EXP_OP_*                  `&  expansion operators
+&` _EXP_VAR_*                 `&  expansion variables
 &` _LOG_*                     `&  log_selector values
 &` _OPT_MAIN_*                `&  main config options
 &` _OPT_ROUTERS_*             `&  generic router options
@@ -6602,7 +6606,7 @@ file that is searched could contain lines like this:
 When the lookup succeeds, the result of the expansion is a list of domains (and
 possibly other types of item that are allowed in domain lists).
 .cindex "tainted data" "de-tainting"
-.cindex "de-tainting" "using a lookup expansion""
+.cindex "de-tainting" "using a lookup expansion"
 The result of the expansion is not tainted.
 
 .next
@@ -11759,8 +11763,8 @@ Case and collation order are defined per the system C locale.
 SRS decode.  See SECT &<<SECTSRS>>& for details.
 
 
-.vitem &*inlist&~{*&<&'string1'&>&*}{*&<&'string2'&>&*}*& &&&
-       &*inlisti&~{*&<&'string1'&>&*}{*&<&'string2'&>&*}*&
+.vitem &*inlist&~{*&<&'subject'&>&*}{*&<&'list'&>&*}*& &&&
+       &*inlisti&~{*&<&'subject'&>&*}{*&<&'list'&>&*}*&
 .cindex "string" "comparison"
 .cindex "list" "iterative conditions"
 Both strings are expanded; the second string is treated as a list of simple
@@ -16193,6 +16197,11 @@ This option is obsolete, and retained only for backward compatibility, because
 nowadays the ACL specified by &%acl_smtp_connect%& can also reject incoming
 connections immediately.
 
+.new
+If the connection is on a TLS-on-connect port then the TCP connection is
+just dropped.  Otherwise, an SMTP error is sent first.
+.wen
+
 The ability to give an immediate rejection (either by this option or using an
 ACL) is provided for use in unusual cases. Many hosts will just try again,
 sometimes without much delay. Normally, it is better to use an ACL to reject
@@ -17683,13 +17692,18 @@ This facility is only available on Linux.
 .cindex "banner for SMTP"
 .cindex "welcome banner for SMTP"
 .cindex "customizing" "SMTP banner"
-This string, which is expanded every time it is used, is output as the initial
+If a connect ACL does not supply a message,
+this string (which is expanded every time it is used) is output as the initial
 positive response to an SMTP connection. The default setting is:
 .code
 smtp_banner = $smtp_active_hostname ESMTP Exim \
   $version_number $tod_full
 .endd
-Failure to expand the string causes a panic error. If you want to create a
+.new
+Failure to expand the string causes a panic error;
+a forced fail just closes the connection.
+.wen
+If you want to create a
 multiline response to the initial SMTP connection, use &"\n"& in the string at
 appropriate points, but not at the end. Note that the 220 code is not included
 in this string. Exim adds it automatically (several times in the case of a
@@ -29778,7 +29792,7 @@ connection.
 The client for the connection proposes a set of protocol names, and
 the server responds with a selected one.
 It is not, as of 2021, commonly used for SMTP connections.
-However, to guard against misirected or malicious use of web clients
+However, to guard against misdirected or malicious use of web clients
 (which often do use ALPN) against MTA ports, Exim by default check that
 there is no incompatible ALPN specified by a client for a TLS connection.
 If there is, the connection is rejected.
@@ -29788,7 +29802,7 @@ The behaviour of both client and server can be configured using the options
 &%tls_alpn%& and &%hosts_require_alpn%&.
 There are no variables providing observability.
 Some feature-specific logging may appear on denied connections, but this
-depends on the behavious of the peer
+depends on the behaviour of the peer
 (not all peers can send a feature-specific TLS Alert).
 
 This feature is available when Exim is built with
@@ -30480,8 +30494,11 @@ accepted by an &%accept%& verb that has a &%message%& modifier, the contents of
 the message override the banner message that is otherwise specified by the
 &%smtp_banner%& option.
 
-For tls-on-connect connections, the ACL is run after the TLS connection
-is accepted (however, &%host_reject_connection%& is tested before).
+.new
+For tls-on-connect connections, the ACL is run before the TLS connection
+is accepted; if the ACL does not accept then the TCP connection is dropped without
+any TLS startup attempt and without any SMTP response being transmitted.
+.wen
 
 
 .subsection "The EHLO/HELO ACL" SECID192
@@ -31632,7 +31649,7 @@ pretrigger=<&'size'&>    This option specifies a memory buffuer to be used
                      immediate writes to file are done as normal.
 
 trigger=<&'reason'&>     This option selects cause for the pretrigger buffer
-                     see above) to be copied to file.  A reason of $*now*
+                     see above) to be copied to file.  A reason of &*now*&
                      take effect immediately; one of &*paniclog*& triggers
                      on a write to the panic log.
 .endd