Added tls_dh_max_bits & check tls_require_ciphers early.

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index c2aa07fb0bbe2f05cae8c6e10b659f139a76570f..da97d40823c5b51b91de3c95e87091713da8c921 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -46,7 +46,7 @@
 . /////////////////////////////////////////////////////////////////////////////
 
 .set previousversion "4.75"
-.set version "4.77"
+.set version "4.80"
 
 .set ACL "access control lists (ACLs)"
 .set I   "    "
@@ -170,15 +170,15 @@
 <bookinfo>
 <title>Specification of the Exim Mail Transfer Agent</title>
 <titleabbrev>The Exim MTA</titleabbrev>
-<date>06 May 2011</date>
+<date>17 May 2012</date>
 <author><firstname>Exim</firstname><surname>Maintainers</surname></author>
 <authorinitials>EM</authorinitials>
 <revhistory><revision>
-  <revnumber>4.77</revnumber>
-  <date>10 Oct 2011</date>
+  <revnumber>4.80</revnumber>
+  <date>17 May 2012</date>
   <authorinitials>EM</authorinitials>
 </revision></revhistory>
-<copyright><year>2011</year><holder>University of Cambridge</holder></copyright>
+<copyright><year>2012</year><holder>University of Cambridge</holder></copyright>
 </bookinfo>
 .literal off
 
@@ -6790,14 +6790,16 @@ white space is ignored.
 .cindex "TXT record" "in &(dnsdb)& lookup"
 .cindex "SPF record" "in &(dnsdb)& lookup"
 .new
-For TXT and SPF records with multiple items of data, only the first item is returned,
+For TXT records with multiple items of data, only the first item is returned,
 unless a separator for them is specified using a comma after the separator
-character followed immediately by the TXT/SPF record item separator. To concatenate
-items without a separator, use a semicolon instead.
+character followed immediately by the TXT record item separator. To concatenate
+items without a separator, use a semicolon instead. For SPF records the
+default behaviour is to concatenate multiple items without using a separator.
 .wen
 .code
 ${lookup dnsdb{>\n,: txt=a.b.example}}
 ${lookup dnsdb{>\n; txt=a.b.example}}
+${lookup dnsdb{spf=example.org}}
 .endd
 It is permitted to specify a space as the separator character. Further
 white space is ignored.
@@ -11948,6 +11950,10 @@ files, for example: Thu Oct 17 17:14:09 1995.
 .vindex "&$tod_epoch$&"
 The time and date as a number of seconds since the start of the Unix epoch.
 
+.vitem &$tod_epoch_l$&
+.vindex "&$tod_epoch_l$&"
+The time and date as a number of microseconds since the start of the Unix epoch.
+
 .vitem &$tod_full$&
 .vindex "&$tod_full$&"
 A full version of the time and date, for example: Wed, 16 Oct 1995 09:51:40
@@ -12688,6 +12694,7 @@ listed in more than one group.
 .row &%tls_advertise_hosts%&         "advertise TLS to these hosts"
 .row &%tls_certificate%&             "location of server certificate"
 .row &%tls_crl%&                     "certificate revocation list"
+.row &%tls_dh_max_bits%&             "clamp D-H bit count suggestion"
 .row &%tls_dhparam%&                 "DH parameters for server"
 .row &%tls_on_connect_ports%&        "specify SSMTP (SMTPS) ports"
 .row &%tls_privatekey%&              "location of server private key"
@@ -15674,6 +15681,25 @@ See &<<SECTtlssni>>& for discussion of when this option might be re-expanded.
 .wen
 
 
+.new
+.option tls_dh_max_bits main integer 2236
+.cindex "TLS" "D-H bit count"
+The number of bits used for Diffie-Hellman key-exchange may be suggested by
+the chosen TLS library.  That value might prove to be too high for
+interoperability.  This option provides a maximum clamp on the value
+suggested, trading off security for interoperability.
+
+The value must be at least 1024.
+
+The value 2236 was chosen because, at time of adding the option, it was the
+hard-coded maximum value supported by the NSS cryptographic library, as used
+by Thunderbird, while GnuTLS was suggesting 2432 bits as normal.
+
+If you prefer more security and are willing to break some clients, raise this
+number.
+.wen
+
+
 .option tls_dhparam main string&!! unset
 .cindex "TLS" "D-H parameters for server"
 The value of this option is expanded, and must then be the absolute path to
@@ -15681,6 +15707,11 @@ a file which contains the server's DH parameter values.
 This is used only for OpenSSL. When Exim is linked with GnuTLS, this option is
 ignored. See section &<<SECTopenvsgnu>>& for further details.
 
+.new
+If the DH bit-count from loading the file is greater than tls_dh_max_bits then
+it will be ignored.
+.end
+
 
 .option tls_on_connect_ports main "string list" unset
 This option specifies a list of incoming SSMTP (aka SMTPS) ports that should
@@ -24559,7 +24590,7 @@ made that any particular new authentication mechanism will be supported
 without code changes in Exim.
 
 
-.option server_channelbinding gsasl bool false
+.option server_channelbinding gsasl boolean false
 Some authentication mechanisms are able to use external context at both ends
 of the session to bind the authentication to that context, and fail the
 authentication process if that context differs.  Specifically, some TLS
@@ -24934,6 +24965,9 @@ name of a directory (for OpenSSL it can be either).
 The &%tls_dhparam%& option is ignored, because early versions of GnuTLS had no
 facility for varying its Diffie-Hellman parameters. I understand that this has
 changed, but Exim has not been updated to provide this facility.
+.new
+Instead, the GnuTLS support will use a file from the spool directory.
+.wen
 .next
 .vindex "&$tls_peerdn$&"
 Distinguished Name (DN) strings reported by the OpenSSL library use a slash for