Docs: add warning on SNI-dependent certfile expansion needing a good default

[users/jgh/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 7608dc680529c5d9a2dd44c650126cfc6f11679d..45d84571869afdeda6b21ff033d6d85639d5e9e4 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -5033,6 +5033,27 @@ address lists. In Exim 4 these are handled better by named lists &-- see
 section &<<SECTnamedlists>>&.
 
 
+.new
+.section "Builtin macros" "SECTbuiltinmacros"
+Exim defines some macros depending on facilities available, which may
+differ due to build-time definitions and from one release to another.
+All of these macros start with an underscore.
+They can be used to conditionally include parts of a configuration
+(see below).
+
+The following classes of macros are defined:
+.display
+&` _HAVE_                     `&  build-time defines
+&` _DRVR_AUTH_                `&  authehticator drivers
+&` _DRVR_RTR_                 `&  router drivers
+&` _DRVR_TPT_                 `&  transport drivers
+&` _OPT_                      `&  configuration option support
+.endd
+
+Use an &"exim -bP macros"& command to get the list of macros.
+.wen
+
+
 .section "Conditional skips in the configuration file" "SECID46"
 .cindex "configuration file" "conditional skips"
 .cindex "&`.ifdef`&"
@@ -27516,8 +27537,13 @@ during TLS session handshake, to permit alternative values to be chosen:
 
 Great care should be taken to deal with matters of case, various injection
 attacks in the string (&`../`& or SQL), and ensuring that a valid filename
-can always be referenced; it is important to remember that &$tls_sni$& is
+can always be referenced; it is important to remember that &$tls_in_sni$& is
 arbitrary unverified data provided prior to authentication.
+.new
+Further, the initial cerificate is loaded before SNI is arrived, so
+an expansion for &%tls_certificate%& must have a default which is used
+when &$tls_in_sni$& is empty.
+.wen
 
 The Exim developers are proceeding cautiously and so far no other TLS options
 are re-expanded.