Documentation for randint. Better randomness defaults. Fixes: #722

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 984d634081187d618c2daea0741bd22a5ca84a69..bf7a987b9eba7b0d34b37415a56745048098ce38 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -1,4 +1,4 @@
-. $Cambridge: exim/doc/doc-docbook/spec.xfpt,v 1.67 2009/11/14 20:35:54 nm4 Exp $
+. $Cambridge: exim/doc/doc-docbook/spec.xfpt,v 1.69 2009/11/16 19:15:36 nm4 Exp $
 .
 . /////////////////////////////////////////////////////////////////////////////
 . This is the primary source of the Exim Manual. It is an xfpt document that is
@@ -9589,6 +9589,17 @@ For single-key lookup types, no quoting is ever necessary and this operator
 yields an unchanged string.
 
 
+.vitem &*${randint:*&<&'n'&>&*}*&
+.cindex "random number"
+This operator returns a somewhat random number which is less than the
+supplied number and is at least 0.  The quality of this randomness depends
+on how Exim was built; the values are not suitable for keying material.
+If Exim is linked against OpenSSL then RAND_pseudo_bytes() is used.
+Otherwise, the implementation may be arc4random(), random() seeded by
+srandomdev() or srandom(), or a custom implementation even weaker than
+random().
+
+
 .vitem &*${rfc2047:*&<&'string'&>&*}*&
 .cindex "expansion" "RFC 2047"
 .cindex "RFC 2047" "expansion operator"
@@ -21480,20 +21491,20 @@ being used, names are looked up using &[gethostbyname()]&
 instead of using the DNS. Of course, that function may in fact use the DNS, but
 it may also consult other sources of information such as &_/etc/hosts_&.
 
-.option gnutls_require_kx main string unset
+.option gnutls_require_kx smtp string unset
 This option controls the key exchange mechanisms when GnuTLS is used in an Exim
 client. For details, see section &<<SECTreqciphgnu>>&.
 
-.option gnutls_require_mac main string unset
+.option gnutls_require_mac smtp string unset
 This option controls the MAC algorithms when GnuTLS is used in an Exim
 client. For details, see section &<<SECTreqciphgnu>>&.
 
-.option gnutls_require_protocols main string unset
+.option gnutls_require_protocols smtp string unset
 This option controls the protocols when GnuTLS is used in an Exim
 client. For details, see section &<<SECTreqciphgnu>>&.
 
 .new
-.option gnutls_compat_mode main boolean unset
+.option gnutls_compat_mode smtp boolean unset
 This option controls whether GnuTLS is used in compatibility mode in an Exim
 server. This reduces security slightly, but improves interworking with older
 implementations of TLS.