fix: proxy-protocol (CVE-2023-41227) Bug 3031

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index eafd56fbadb2ccc18b1d26386ce98b2eb00bd2d9..afa77a65f14d83d31ea407026b9ca0668742b33b 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -14898,6 +14898,7 @@ listed in more than one group.
 .row &%gnutls_compat_mode%&          "use GnuTLS compatibility mode"
 .row &%gnutls_allow_auto_pkcs11%&    "allow GnuTLS to autoload PKCS11 modules"
 .row &%hosts_require_alpn%&          "mandatory ALPN"
+.row &%hosts_require_helo%&          "mandatory HELO/EHLO"
 .row &%openssl_options%&             "adjust OpenSSL compatibility options"
 .row &%tls_advertise_hosts%&         "advertise TLS to these hosts"
 .row &%tls_alpn%&                   "acceptable protocol names"
@@ -16401,6 +16402,12 @@ See also the &%tls_alpn%& option.
 managed by this option, and should be done separately.
 
 
+.option hosts_require_helo main "host list&!!" *
+.cindex "HELO/EHLO" requiring
+Exim will require an accepted HELO or EHLO command from a host matching
+this list, before accepting a MAIL command.
+
+
 .option hosts_proxy main "host list&!!" unset
 .cindex proxy "proxy protocol"
 This option enables use of Proxy Protocol proxies for incoming
@@ -17129,9 +17136,9 @@ not count as protocol errors (see &%smtp_max_synprot_errors%&).
 
 .option pipelining_connect_advertise_hosts main "host list&!!" *
 .cindex "pipelining" "early connection"
-.cindex "pipelining" PIPE_CONNECT
-.cindex "ESMTP extensions" PIPE_CONNECT
-If Exim is built with the SUPPORT_PIPE_CONNECT build option
+.cindex "pipelining" PIPECONNECT
+.cindex "ESMTP extensions" PIPECONNECT
+If Exim is built without the DISABLE_PIPE_CONNECT build option
 this option controls which hosts the facility is advertised to
 and from which pipeline early-connection (before MAIL) SMTP
 commands are acceptable.
@@ -17139,7 +17146,11 @@ When used, the pipelining saves on roundtrip times.
 
 See also the &%hosts_pipe_connect%& smtp transport option.
 
-The SMTP service extension keyword advertised is &"PIPE_CONNECT"&.
+The SMTP service extension keyword advertised is &"PIPECONNECT"&;
+it permits the client to pipeline
+TCP connection and hello command (inclear phase),
+or TLS-establishment and hello command (encrypted phase),
+on later connections to the same host.
 
 
 .option prdr_enable main boolean false
@@ -25642,7 +25653,7 @@ that matches this list, even if the server host advertises PIPELINING support.
 
 .option hosts_pipe_connect smtp "host list&!!" unset
 .cindex "pipelining" "early connection"
-.cindex "pipelining" PIPE_CONNECT
+.cindex "pipelining" PIPECONNECT
 If Exim is built with the SUPPORT_PIPE_CONNECT build option
 this option controls which to hosts the facility watched for
 and recorded, and used for subsequent connections.
@@ -25792,11 +25803,6 @@ There will be no fallback to in-clear communication.
 See the &%dnssec_request_domains%& router and transport options.
 See section &<<SECDANE>>&.
 
-.option hosts_require_helo smtp "host list&!!" *
-.cindex "HELO/EHLO" requiring
-Exim will require an accepted HELO or EHLO command from a host matching
-this list, before accepting a MAIL command.
-
 .option hosts_require_ocsp smtp "host list&!!" unset
 .cindex "TLS" "requiring for certain servers"
 Exim will request, and check for a valid Certificate Status being given, on a
@@ -31717,6 +31723,8 @@ with &`-d`&, with the output going to a new logfile in the usual logs directory,
 by default called &'debuglog'&.
 
 .new
+Logging set up by the control will be maintained across spool residency.
+
 Options are a slash-separated list.
 If an option takes an argument, the option name and argument are separated by
 an equals character.
@@ -38454,7 +38462,7 @@ LOG_FILE_PATH, and uses the first item it finds that is neither empty nor
 &"syslog"&. This means that an empty item in &%log_file_path%& can be used to
 mean &"use the path specified at build time"&. If no such item exists, log
 files are written in the &_log_& subdirectory of the spool directory. This is
-equivalent to the setting:
+equivalent to the configuration file setting:
 .code
 log_file_path = $spool_directory/log/%slog
 .endd
@@ -38465,7 +38473,7 @@ that is where the logs are written.
 A log file path may also contain &`%D`& or &`%M`& if datestamped log filenames
 are in use &-- see section &<<SECTdatlogfil>>& below.
 
-Here are some examples of possible settings:
+Here are some examples of possible Makefile settings:
 .display
 &`LOG_FILE_PATH=syslog                    `& syslog only
 &`LOG_FILE_PATH=:syslog                   `& syslog and default path
@@ -39221,7 +39229,7 @@ On accept lines, where PIPELINING was offered but not used by the client,
 the field has a minus appended.
 
 .cindex "pipelining" "early connection"
-If Exim is built with the SUPPORT_PIPE_CONNECT build option
+If Exim is built without the DISABLE_PIPE_CONNECT build option
 accept "L" fields have a period appended if the feature was
 offered but not used, or an asterisk appended if used.
 Delivery "L" fields have an asterisk appended if used.
@@ -41501,6 +41509,7 @@ The domain(s) you want to sign with.
 After expansion, this can be a list.
 Each element in turn,
 lowercased,
+.vindex "&$dkim_domain$&"
 is put into the &%$dkim_domain%& expansion variable
 while expanding the remaining signing options.
 If it is empty after expansion, DKIM signing is not done,
@@ -41510,6 +41519,7 @@ and no error will result even if &%dkim_strict%& is set.
 This sets the key selector string.
 After expansion, which can use &$dkim_domain$&, this can be a list.
 Each element in turn is put in the expansion
+.vindex "&$dkim_selector$&"
 variable &%$dkim_selector%& which may be used in the &%dkim_private_key%&
 option along with &%$dkim_domain%&.
 If the option is empty after expansion, DKIM signing is not done for this domain,
@@ -42163,6 +42173,9 @@ There is no need to periodically change this key; a timestamp is also
 encoded.
 The second argument should be given as the envelope sender address before this
 encoding operation.
+.new
+If this value is empty the the expansion result will be empty.
+.wen
 The third argument should be the recipient domain of the message when
 it arrived at this system.
 .endlist