X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/dae124ff1a33721637d0be99181a4783ee46e25f..ef2e5890df09193717f9d345ffaaa406e2d8aae7:/doc/doc-docbook/spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index b20d82311..ed5b06a2d 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -18481,8 +18481,17 @@ of the later IKE values, which led into RFC7919 providing new fixed constants
 (the "ffdhe" identifiers).
 
 At this point, all of the "ike" values should be considered obsolete;
-they're still in Exim to avoid breaking unusual configurations, but are
+they are still in Exim to avoid breaking unusual configurations, but are
 candidates for removal the next time we have backwards-incompatible changes.
+.new
+Two of them in particular (&`ike1`& and &`ike22`&) are called out by RFC 8247
+as MUST NOT use for IPSEC, and two more (&`ike23`& and &`ike24`&) as
+SHOULD NOT.
+Because of this, Exim regards them as deprecated; if either of the first pair
+are used, warnings will be logged in the paniclog, and if any are used then
+warnings will be logged in the mainlog.
+All four will be removed in a future Exim release.
+.wen
 
 The TLS protocol does not negotiate an acceptable size for this; clients tend
 to hard-drop connections if what is offered by the server is unacceptable,
@@ -30460,6 +30469,11 @@ accepted by an &%accept%& verb that has a &%message%& modifier, the contents of
 the message override the banner message that is otherwise specified by the
 &%smtp_banner%& option.
 
+.new
+For tls-on-connect connections, the ACL is run after the TLS connection
+is accepted (however, &%host_reject_connection%& is tested before).
+.wen
+
 
 .section "The EHLO/HELO ACL" "SECID192"
 .cindex "EHLO" "ACL for"
@@ -42595,6 +42609,7 @@ Events have names which correspond to the point in process at which they fire.
 The name is placed in the variable &$event_name$& and the event action
 expansion must check this, as it will be called for every possible event type.
 
+.new
 The current list of events is:
 .display
 &`dane:fail              after    transport  `& per connection
@@ -42609,9 +42624,11 @@ The current list of events is:
 &`tcp:connect            before   transport  `& per connection
 &`tcp:close              after    transport  `& per connection
 &`tls:cert               before   both       `& per certificate in verification chain
+&`tls:fail:connect       after    main       `& per connection
 &`smtp:connect           after    transport  `& per connection
 &`smtp:ehlo              after    transport  `& per connection
 .endd
+.wen
 New event types may be added in future.
 
 The event name is a colon-separated list, defining the type of
@@ -42637,6 +42654,7 @@ with the event type:
 &`msg:rcpt:host:defer  `& error string
 &`msg:rcpt:defer       `& error string
 &`tls:cert             `& verification chain depth
+&`tls:fail:connect     `& error string
 &`smtp:connect         `& smtp banner
 &`smtp:ehlo            `& smtp ehlo response
 .endd