Better logging of OCSP fails

[users/jgh/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 2e2d2f9650b79dac6b4e57f754b82ee45eb6a967..aa9d23ddbf03b2e19a422887b81ae9129f505120 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -5556,10 +5556,12 @@ unreachable.
 
 The next two lines are concerned with &'ident'& callbacks, as defined by RFC
 1413 (hence their names):
+.new
 .code
-rfc1413_query_hosts = *
+rfc1413_hosts = *
 rfc1413_query_timeout = 0s
 .endd
+.wen
 These settings cause Exim to avoid ident callbacks for all incoming SMTP calls.
 Few hosts offer RFC1413 service these days; calls have to be
 terminated by a timeout and this needlessly delays the startup
@@ -10997,6 +10999,13 @@ precedes the expansion of the string. For example, the commands available in
 Exim filter files include an &%if%& command with its own regular expression
 matching condition.
 
+.new
+.vitem "&$acl_arg1$&, &$acl_arg2$&, etc"
+Within an acl condition, expansion condition or expansion item
+any arguments are copied to these variables,
+any unused variables being made empty.
+.wen
+
 .vitem "&$acl_c...$&"
 Values can be placed in these variables by the &%set%& modifier in an ACL. They
 can be given any name that starts with &$acl_c$& and is at least six characters
@@ -11018,6 +11027,12 @@ message is received, the values of these variables are saved with the message,
 and can be accessed by filters, routers, and transports during subsequent
 delivery.
 
+.new
+.vitem &$acl_narg$&
+Within an acl condition, expansion condition or expansion item
+this variable has the number of arguments.
+.wen
+
 .vitem &$acl_verify_message$&
 .vindex "&$acl_verify_message$&"
 After an address verification has failed, this variable contains the failure
@@ -12408,6 +12423,26 @@ and then set to the outgoing cipher suite if one is negotiated. See chapter
 &<<CHAPTLS>>& for details of TLS support and chapter &<<CHAPsmtptrans>>& for
 details of the &(smtp)& transport.
 
+.new
+.vitem &$tls_in_ocsp$&
+.vindex "&$tls_in_ocsp$&"
+When a message is received from a remote client connection
+the result of any OCSP request from the client is encoded in this variable:
+.code
+0 OCSP proof was not requested (default value)
+1 No response to request
+2 Response not verified
+3 Verification failed
+4 Verification succeeded
+.endd
+
+.vitem &$tls_out_ocsp$&
+.vindex "&$tls_out_ocsp$&"
+When a message is sent to a remote host connection
+the result of any OCSP request made is encoded in this variable.
+See &$tls_in_ocsp$& for values.
+.wen
+
 .vitem &$tls_in_peerdn$&
 .vindex "&$tls_in_peerdn$&"
 .vindex "&$tls_peerdn$&"
@@ -25363,6 +25398,9 @@ but it is present in many binary distributions.
 .scindex IIDdcotauth2 "authenticators" "&(dovecot)&"
 This authenticator is an interface to the authentication facility of the
 Dovecot POP/IMAP server, which can support a number of authentication methods.
+.new
+Note that Dovecot must be configured to use auth-client not auth-userdb.
+.wen
 If you are using Dovecot to authenticate POP/IMAP clients, it might be helpful
 to use the same mechanisms for SMTP authentication. This is a server
 authenticator only. There is only one option:
@@ -26231,6 +26269,10 @@ file named by &%tls_ocsp_file%&.
 Note that the proof only covers the terminal server certificate,
 not any of the chain from CA to it.
 
+.new
+There is no current way to staple a proof for a client certificate.
+.wen
+
 .code
   A helper script "ocsp_fetch.pl" for fetching a proof from a CA
   OCSP server is supplied.  The server URL may be included in the