PIPE_CONNECT: avoid using when the transport helo_data uses $sending_ip_address

[exim.git] / doc / doc-txt / experimental-spec.txt

diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index f304cf455127cef1e58afd1510e3fdc6182d0243..328d0940a6e059dd403bcab5fedbf2a78570d6cc 100644 (file)
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -941,6 +941,9 @@ change.
 
 NOTE: since the EHLO command must be constructed before the connection is
 made it cannot depend on the interface IP address that will be used.
+The string "$sending_ip_address" is checked for; if it appears in helo_data
+and "def:sending_ip_address" does not, the facility is disabled.
+
 Transport configurations should be checked for this.  An example avoidance:
 
  helo_data =   ${if def:sending_ip_address \
@@ -984,7 +987,10 @@ Security aspects:
  vulnarability surface.  An attacker able to decrypt it would have access
  all connections using the resumed session.
  The session ticket encryption key is not committed to storage by the server
- and is rotated regularly.  Tickets have limited lifetime.
+ and is rotated regularly (OpenSSL: 1hr, and one previous key is used for
+ overlap; GnuTLS 6hr but does not specify any overlap).
+ Tickets have limited lifetime (2hr, and new ones issued after 1hr under
+ OpenSSL.  GnuTLS 2hr, appears to not do overlap).
 
  There is a question-mark over the security of the Diffie-Helman parameters
  used for session negotiation. TBD.  q-value; cf bug 1895
@@ -1000,12 +1006,9 @@ Observability:
 
 Issues:
  In a resumed session:
-  $tls_{in,out}_certificate_verified will be set, and verify = certificate
-    will be true, when verify failed but tls_try_verify_hosts allowed the
-    connection (under OpenSSL)
   $tls_{in,out}_cipher will have values different to the original (under GnuTLS)
   $tls_{in,out}_ocsp will be "not requested" or "no response", and
-  hosts_require_ocsp will fail
+   hosts_require_ocsp will fail
 
 
 --------------------------------------------------------------