Auths: in plaintext authenticator, fix parsing of consecutive circuflex. Bug 2687

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 55ccb1632b5727a8bac1935abbe7b14da873621e..15b03eabbe43909ca04e7feb8dc99b6164ce7b05 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -27824,7 +27824,14 @@ fixed_plain:
   client_send = ^username^mysecret
 .endd
 The lack of colons means that the entire text is sent with the AUTH
   client_send = ^username^mysecret
 .endd
 The lack of colons means that the entire text is sent with the AUTH

-command, with the circumflex characters converted to NULs. A similar example
+command, with the circumflex characters converted to NULs.
+.new
+Note that due to the ambiguity of parsing three consectutive circumflex characters
+there is no way to provide a password having a leading circumflex.
+.wen
+
+
+A similar example

 that uses the LOGIN mechanism is:
 .code
 fixed_login:
 that uses the LOGIN mechanism is:
 .code
 fixed_login:


@@ -28181,6 +28188,10 @@ supplied by the server.
 .option server_channelbinding gsasl boolean false
 Do not set this true and rely on the properties
 without consulting a cryptographic engineer.
 .option server_channelbinding gsasl boolean false
 Do not set this true and rely on the properties
 without consulting a cryptographic engineer.

+. Unsure what that's about.  It might be the "Triple Handshake"
+. vulnerability; cf. https://www.mitls.org/pages/attacks/3SHAKE
+. If so, we're ok, requiring Extended Master Secret if TLS
+. Session Resumption was used.

 
 Some authentication mechanisms are able to use external context at both ends
 of the session to bind the authentication to that context, and fail the
 
 Some authentication mechanisms are able to use external context at both ends
 of the session to bind the authentication to that context, and fail the


@@ -38315,7 +38326,7 @@ flagged with &`->`& instead of &`=>`&. When two or more messages are delivered
 down a single SMTP connection, an asterisk follows the
 .new
 remote IP address (and port if enabled)
 down a single SMTP connection, an asterisk follows the
 .new
 remote IP address (and port if enabled)

-.ewn
+.wen

 in the log lines for the second and subsequent messages.
 When two or more messages are delivered down a single TLS connection, the
 DNS and some TLS-related information logged for the first message delivered
 in the log lines for the second and subsequent messages.
 When two or more messages are delivered down a single TLS connection, the
 DNS and some TLS-related information logged for the first message delivered