X-Git-Url: https://git.exim.org/users/jgh/exim.git/blobdiff_plain/b4f579d134197249b448cb5d8abf801ba4c729bb..14ca5d2ac6c3536fe189435269a302ef14e972cf:/doc/doc-docbook/spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 5463cc1a5..32d57d027 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -2528,6 +2528,8 @@ use of Exim's filtering capabilities, you should make the document entitled
 If you are already running Exim on your host, building and installing a new
 version automatically makes it available to MUAs, or any other programs that
 call the MTA directly. However, if you are running an Exim daemon, you do need
+.cindex restart "on HUP signal"
+.cindex signal "HUP, to restart"
 to send it a HUP signal, to make it re-execute itself, and thereby pick up the
 new binary. You do not need to stop processing mail in order to install a new
 version of Exim. The install script does not modify an existing runtime
@@ -2766,9 +2768,12 @@ used to specify a path on the command line if a pid file is required.
 
 The SIGHUP signal
 .cindex "SIGHUP"
+.cindex restart "on HUP signal"
+.cindex signal "HUP, to restart"
 .cindex "daemon" "restarting"
 .cindex signal "to reload configuration"
 .cindex daemon "reload configuration"
+.cindex reload configuration
 can be used to cause the daemon to re-execute itself. This should be done
 whenever Exim's configuration file, or any file that is incorporated into it by
 means of the &%.include%& facility, is changed, and also whenever a new version
@@ -9214,7 +9219,13 @@ dependent upon the option for which a value is sought; in this documentation,
 options for which string expansion is performed are marked with † after
 the data type.  ACL rules always expand strings.  A couple of expansion
 conditions do not expand some of the brace-delimited branches, for security
-reasons.
+reasons,
+.new
+.cindex "tainted data" expansion
+.cindex expansion "tainted data"
+and expansion of data deriving from the sender (&"tainted data"&)
+is not permitted.
+.wen
 
 
 
@@ -19011,13 +19022,12 @@ matters.
 .cindex router variables
 This option may be used multiple times on a router;
 because of this the list aspect is mostly irrelevant.
-The list separator is a colon but can be changed in the
+The list separator is a semicolon but can be changed in the
 usual way.
 
 Each list-element given must be of the form $"name = value"$
 and the names used must start with the string &"r_"&.
-Values containing colons should either have them doubled, or
-the entire list should be prefixed with a list-separator change.
+Values containing a list-separator should have them doubled.
 When a router runs, the strings are evaluated in order,
 to create variables which are added to the set associated with
 the address.
@@ -28478,6 +28488,13 @@ transport provide the client with a certificate, which is passed to the server
 if it requests it. If the server is Exim, it will request a certificate only if
 &%tls_verify_hosts%& or &%tls_try_verify_hosts%& matches the client.
 
+.new
+Do not use a certificate which has the OCSP-must-staple extension,
+for client use (they are usable for server use).
+As TLS has no means for the client to staple before TLS 1.3 it will result
+in failed connections.
+.wen
+
 If the &%tls_verify_certificates%& option is set on the &(smtp)& transport, it
 specifies a collection of expected server certificates.
 These may be
@@ -39532,6 +39549,11 @@ was received from the client, this records the Distinguished Name from that
 certificate.
 .endlist
 
+.new
+Any of the above may have an extra hyphen prepended, to indicate the the
+corresponding data is untrusted.
+.wen
+
 Following the options there is a list of those addresses to which the message
 is not to be delivered. This set of addresses is initialized from the command
 line when the &%-t%& option is used and &%extract_addresses_remove_arguments%&