Make transport name available in verify-callouts. Add verify_mode variable

[users/jgh/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 9cfc06ca5fbac4ee77d1a82485fbeee71b2202a1..d3a28a40aead7ead59b8dfe81ada8ccca5690cfb 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -12592,6 +12592,13 @@ This variable contains the result of an expansion lookup, extraction operation,
 or external command, as described above. It is also used during a
 &*reduce*& expansion.
 
+.vitem &$verify_mode$&
+.vindex "&$verify_mode$&"
+While a router or transport is being run in verify mode
+or for cutthrough delivery,
+contains "S" for sender-verification or "R" for recipient-verification.
+Otherwise, empty.
+
 .vitem &$version_number$&
 .vindex "&$version_number$&"
 The version number of Exim.
@@ -16484,9 +16491,11 @@ See &%tls_verify_hosts%& below.
 The value of this option is expanded, and must then be the absolute path to
 a file containing permitted certificates for clients that
 match &%tls_verify_hosts%& or &%tls_try_verify_hosts%&. Alternatively, if you
-are using OpenSSL, you can set &%tls_verify_certificates%& to the name of a
-directory containing certificate files. This does not work with GnuTLS; the
-option must be set to the name of a single file if you are using GnuTLS.
+are using either GnuTLS version 3.3.6 (or later) or OpenSSL,
+you can set &%tls_verify_certificates%& to the name of a
+directory containing certificate files.
+For earlier versions of GnuTLS
+the option must be set to the name of a single file.
 
 These certificates should be for the certificate authorities trusted, rather
 than the public cert of individual clients.  With both OpenSSL and GnuTLS, if
@@ -17777,6 +17786,7 @@ delivering in cutthrough mode
 or testing recipient verification using &%-bv%&.
 See section &<<SECTrouprecon>>& for a list of the order in which preconditions
 are evaluated.
+See also the &$verify_mode$& variable.
 
 
 .option verify_sender routers&!? boolean true
@@ -17784,6 +17794,7 @@ If this option is false, the router is skipped when verifying sender addresses
 or testing sender verification using &%-bvs%&.
 See section &<<SECTrouprecon>>& for a list of the order in which preconditions
 are evaluated.
+See also the &$verify_mode$& variable.
 .ecindex IIDgenoprou1
 .ecindex IIDgenoprou2
 
@@ -23432,10 +23443,14 @@ certificate verification succeeds.
 .vindex "&$host_address$&"
 The value of this option must be the absolute path to a file containing
 permitted server certificates, for use when setting up an encrypted connection.
-Alternatively, if you are using OpenSSL, you can set
+Alternatively,
+if you are using either GnuTLS version 3.3.6 (or later) or OpenSSL,
+you can set
 &%tls_verify_certificates%& to the name of a directory containing certificate
-files. This does not work with GnuTLS; the option must be set to the name of a
-single file if you are using GnuTLS. The values of &$host$& and
+files.
+For earlier versions of GnuTLS the option must be set to the name of a
+single file.
+The values of &$host$& and
 &$host_address$& are set to the name and address of the server during the
 expansion of this option. See chapter &<<CHAPTLS>>& for details of TLS.
 
@@ -25917,7 +25932,8 @@ There are some differences in usage when using GnuTLS instead of OpenSSL:
 
 .ilist
 The &%tls_verify_certificates%& option must contain the name of a file, not the
-name of a directory (for OpenSSL it can be either).
+name of a directory for GnuTLS versions before 3.3.6
+(for later versions, or OpenSSL, it can be either).
 .next
 The default value for &%tls_dhparam%& differs for historical reasons.
 .next