Docs: additional possible result from spf check. Bug 2786

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 0915da3e67329db3b5b237cf5d71c02e91835304..2125a12ba0d8d3e2bf43e04dfa6b55f123fb37d1 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -239,6 +239,14 @@
   <secondary>failure report</secondary>
   <see><emphasis>bounce message</emphasis></see>
 </indexterm>
+<indexterm role="concept">
+  <primary>de-tainting</primary>
+  <see><emphasis>tainting, de-tainting</emphasis></see>
+</indexterm>
+<indexterm role="concept">
+  <primary>detainting</primary>
+  <see><emphasis>tainting, de-tainting</emphasis></see>
+</indexterm>
 <indexterm role="concept">
   <primary>dialup</primary>
   <see><emphasis>intermittently connected hosts</emphasis></see>
@@ -9606,6 +9614,8 @@ reasons,
 and expansion of data deriving from the sender (&"tainted data"&)
 .new
 is not permitted (including acessing a file using a tainted name).
+The main config option &%allow_insecure_tainted_data%& can be used as
+mitigation during uprades to more secure configurations.
 .wen
 
 .new
@@ -14590,6 +14600,7 @@ listed in more than one group.
 .section "Miscellaneous" "SECID96"
 .table2
 .row &%add_environment%&             "environment variables"
+.row &%allow_insecure_tainted_data%& "turn taint errors into warnings"
 .row &%bi_command%&                  "to run for &%-bi%& command line option"
 .row &%debug_store%&                 "do extra internal checks"
 .row &%disable_ipv6%&                "do no IPv6 processing"
@@ -14714,7 +14725,7 @@ listed in more than one group.
 .row &%notifier_socket%&             "override compiled-in value"
 .row &%pid_file_path%&               "override compiled-in value"
 .row &%queue_run_max%&               "maximum simultaneous queue runners"
-.row &%smtp_backlog_monitor%&        "level to log listen baclog"
+.row &%smtp_backlog_monitor%&        "level to log listen backlog"
 .endtable
 
 
@@ -15201,6 +15212,18 @@ domains (defined in the named domain list &%local_domains%& in the default
 configuration). This &"magic string"& matches the domain literal form of all
 the local host's IP addresses.
 
+.new
+.option allow_insecure_tainted_data main boolean false
+.cindex "de-tainting"
+.oindex "allow_insecure_tainted_data"
+The handling of tainted data may break older (pre 4.94) configurations.
+Setting this option to "true" turns taint errors (which result in a temporary
+message rejection) into warnings. This option is meant as mitigation only
+and deprecated already today. Future releases of Exim may ignore it.
+The &%taint%& log selector can be used to suppress even the warnings.
+.wen
+
+
 
 .option allow_mx_to_ip main boolean false
 .cindex "MX record" "pointing to IP address"
@@ -38750,6 +38773,7 @@ selection marked by asterisks:
 &` smtp_protocol_error        `&  SMTP protocol errors
 &` smtp_syntax_error          `&  SMTP syntax errors
 &` subject                    `&  contents of &'Subject:'& on <= lines
+&`*taint                      `&  taint errors or warnings
 &`*tls_certificate_verified   `&  certificate verification status
 &`*tls_cipher                 `&  TLS cipher suite on <= and => lines
 &` tls_peerdn                 `&  TLS peer DN on <= and => lines
@@ -39145,6 +39169,11 @@ using a CA trust anchor,
 &`CV=dane`& if using a DNS trust anchor,
 and &`CV=no`& if not.
 .next
+.cindex "log" "Taint warnings"
+&%taint%&: Log warnings about tainted data. This selector can't be
+turned of if &%allow_insecure_tainted_data%& is false (which is the
+default).
+.next
 .cindex "log" "TLS cipher"
 .cindex "TLS" "logging cipher"
 &%tls_cipher%&: When a message is sent or received over an encrypted
@@ -41707,6 +41736,9 @@ You may deny messages when this occurs.
 .vitem &%temperror%&
 This indicates a temporary error during all processing, including Exim's
 SPF processing.  You may defer messages when this occurs.
+
+.vitem &%invalid%&
+There was an error during processing of the SPF lookup
 .endlist
 
 You can prefix each string with an exclamation mark to  invert
@@ -41754,8 +41786,8 @@ variables:
 .vitem &$spf_result$&
 .vindex &$spf_result$&
   This contains the outcome of the SPF check in string form,
-  one of pass, fail, softfail, none, neutral, permerror or
-  temperror.
+  currently one of pass, fail, softfail, none, neutral, permerror,
+  temperror, or &"(invalid)"&.
 
 .vitem &$spf_result_guessed$&
 .vindex &$spf_result_guessed$&