Move connect ACL before TLS-on-connect

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 15d909be02188b140a33a1eb933268f8c046cc99..1b3c2b45405d8e326e608b93b2d7cfbd12c65b8c 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -5103,6 +5103,10 @@ The following classes of macros are defined:
 &` _DRIVER_ROUTER_*           `&  router drivers
 &` _DRIVER_TRANSPORT_*        `&  transport drivers
 &` _DRIVER_AUTHENTICATOR_*    `&  authenticator drivers
+&` _EXP_COND_*                `&  expansion conditions
+&` _EXP_ITEM_*                `&  expansion items
+&` _EXP_OP_*                  `&  expansion operators
+&` _EXP_VAR_*                 `&  expansion variables
 &` _LOG_*                     `&  log_selector values
 &` _OPT_MAIN_*                `&  main config options
 &` _OPT_ROUTERS_*             `&  generic router options
@@ -16189,11 +16193,13 @@ case. That is why the default tries a DNS lookup first.
 .cindex "host" "rejecting connections from"
 If this option is set, incoming SMTP calls from the hosts listed are rejected
 as soon as the connection is made.
-This option is mostly obsolete, retained for backward compatibility because
+This option is obsolete, and retained only for backward compatibility, because
 nowadays the ACL specified by &%acl_smtp_connect%& can also reject incoming
-connections immediately
+connections immediately.
+
 .new
-(except for tls-on-connect connections).
+If the connection is on a TLS-on-connect port then the TCP connection is
+just dropped.  Otherwise, an SMTP error is sent first.
 .wen
 
 The ability to give an immediate rejection (either by this option or using an
@@ -30483,8 +30489,11 @@ accepted by an &%accept%& verb that has a &%message%& modifier, the contents of
 the message override the banner message that is otherwise specified by the
 &%smtp_banner%& option.
 
-For tls-on-connect connections, the ACL is run after the TLS connection
-is accepted (however, &%host_reject_connection%& is tested before).
+.new
+For tls-on-connect connections, the ACL is run before the TLS connection
+is accepted; if the ACL does not accept then the TCP connection is dropped without
+any TLS startup attempt and without any SMTP response being transmitted.
+.wen
 
 
 .subsection "The EHLO/HELO ACL" SECID192