X-Git-Url: https://git.exim.org/users/heiko/exim.git/blobdiff_plain/27607d0311c4b32440c6a3396e4a022640dd930e..efad2f414afac1b1456299e79b1cdc705b84b71e:/doc/doc-docbook/spec.xfpt?ds=sidebyside

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index e2f1eafe1..bfacdef81 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -10957,11 +10957,15 @@ If the string is a single variable of type certificate,
 returns the SHA-1 hash fingerprint of the certificate.
 
 
-.vitem &*${sha256:*&<&'string'&>&*}*&
+.vitem &*${sha256:*&<&'string'&>&*}*& &&&
+       &*${sha2:*&<&'string'&>&*}*& &&&
+       &*${sha2_<n>:*&<&'string'&>&*}*&
 .cindex "SHA-256 hash"
+.cindex "SHA-2 hash"
 .cindex certificate fingerprint
 .cindex "expansion" "SHA-256 hashing"
 .cindex "&%sha256%& expansion item"
+.cindex "&%sha2%& expansion item"
 The &%sha256%& operator computes the SHA-256 hash value of the string
 and returns
 it as a 64-digit hexadecimal number, in which any letters are in upper case.
@@ -10969,6 +10973,15 @@ it as a 64-digit hexadecimal number, in which any letters are in upper case.
 If the string is a single variable of type certificate,
 returns the SHA-256 hash fingerprint of the certificate.
 
+.new
+The operator can also be spelled &%sha2%& and does the same as &%sha256%&
+(except for certificates, which are not supported).
+Finally, if an underbar
+and a number is appended it specifies the output length, selecting a
+member of the SHA-2 family of hash functions.
+Values of 256, 384 and 512 are accepted, with 256 being the default.
+.wen
+
 
 .vitem &*${sha3:*&<&'string'&>&*}*& &&&
        &*${sha3_<n>:*&<&'string'&>&*}*&
@@ -24579,13 +24592,15 @@ been started will not be passed to a new delivery process for sending another
 message on the same connection. See section &<<SECTmulmessam>>& for an
 explanation of when this might be needed.
 
-.option hosts_noproxy_tls smtp "host list&!!" *
+.new
+.option hosts_noproxy_tls smtp "host list&!!" unset
 .cindex "TLS" "passing connection"
 .cindex "multiple SMTP deliveries"
 .cindex "TLS" "multiple message deliveries"
 For any host that matches this list, a TLS session which has
 been started will not be passed to a new delivery process for sending another
 message on the same session.
+.wen
 
 The traditional implementation closes down TLS and re-starts it in the new
 process, on the same open TCP connection, for each successive message
@@ -24681,7 +24696,7 @@ This option provides a list of servers to which, provided they announce
 CHUNKING support, Exim will attempt to use BDAT commands rather than DATA.
 BDAT will not be used in conjunction with a transport filter.
 
-.option hosts_try_dane smtp "host list&!!" unset
+.option hosts_try_dane smtp "host list&!!" *
 .cindex DANE "transport options"
 .cindex DANE "attempting for certain servers"
 If built with DANE support, Exim  will lookup a
@@ -24691,7 +24706,7 @@ a DANE-verified TLS connection is made to that host;
 there will be no fallback to in-clear communication.
 See section &<<SECDANE>>&.
 
-.option hosts_try_fastopen smtp "host list&!!" unset
+.option hosts_try_fastopen smtp "host list&!!" *
 .cindex "fast open, TCP" "enabling, in client"
 .cindex "TCP Fast Open" "enabling, in client"
 .cindex "RFC 7413" "TCP Fast Open"