active (in the middle of a delivery attempt), it is not altered. This option
can be used only by an admin user.
-.vitem "&%-MC%&&~<&'transport'&>&~<&'hostname'&>&~<&'sequence&~number'&>&&&
+.vitem "&%-MC%&&~<&'transport'&>&~<&'hostname'&>&&&
+ &~<&'host&~IP'&>&&&
+ &~<&'sequence&~number'&>&&&
&~<&'message&~id'&>"
.oindex "&%-MC%&"
.cindex "SMTP" "passed connection"
those headers that contain lists of addresses, a comma is also inserted at the
junctions between headers. This does not happen for the &%rheader%& expansion.
-.cindex "tainted data"
+.cindex "tainted data" "message headers"
When the headers are from an incoming message,
the result of expanding any of these variables is tainted.
example, a system filter could set a value indicating how likely it is that a
message is junk mail.
-.vitem &$spam_$&&'xxx'&
+.vitem &$spam_score$& &&&
+ &$spam_score_int$& &&&
+ &$spam_bar$& &&&
+ &$spam_report$& &&&
+ &$spam_action$&
A number of variables whose names start with &$spam$& are available when Exim
is compiled with the content-scanning extension. For details, see section
&<<SECTscanspamass>>&.
option to a true value. To avoid breaking existing installations, it
defaults to false.
+.new
+&*Note*&: This is entirely separate from Exim's tainted-data tracking.
+.wen
+
.section "Calling Perl subroutines" "SECID86"
When the configuration file includes a &%perl_startup%& option you can make use
.option pipelining_connect_advertise_hosts main "host list&!!" *
.cindex "pipelining" "early connection"
.cindex "pipelining" PIPE_CONNECT
-.cindex "ESMTP extensions" X_PIPE_CONNECT
+.cindex "ESMTP extensions" PIPE_CONNECT
If Exim is built with the SUPPORT_PIPE_CONNECT build option
this option controls which hosts the facility is advertised to
and from which pipeline early-connection (before MAIL) SMTP
See also the &%hosts_pipe_connect%& smtp transport option.
-Currently the option name &"X_PIPE_CONNECT"& is used.
+.new
+The SMTP service extension keyword advertised is &"PIPE_CONNECT"&.
+.wen
.option prdr_enable main boolean false
When a router runs, the strings are evaluated in order,
to create variables which are added to the set associated with
the address.
+.new
+This is done immediately after all the preconditions, before the
+evaluation of the &%address_data%& option.
+.wen
The variable is set with the expansion of the value.
The variables can be used by the router options
(not including any preconditions)
.ilist
The client host must match &%auth_advertise_hosts%& (default *).
.next
-It the &%server_advertise_condition%& option is set, its expansion must not
+If the &%server_advertise_condition%& option is set, its expansion must not
yield the empty string, &"0"&, &"no"&, or &"false"&.
.endlist
.endd
gives an incorrect answer because of the unescaped &"@"& and &"$"& characters.
-If you have the &%mimencode%& command installed, another way to do produce
+If you have the &%mimencode%& command installed, another way to produce
base64-encoded strings is to run the command
.code
echo -e -n `\0user\0password' | mimencode
client_send = ^username^mysecret
.endd
The lack of colons means that the entire text is sent with the AUTH
-command, with the circumflex characters converted to NULs. A similar example
+command, with the circumflex characters converted to NULs.
+.new
+Note that due to the ambiguity of parsing three consectutive circumflex characters
+there is no way to provide a password having a leading circumflex.
+.wen
+
+
+A similar example
that uses the LOGIN mechanism is:
.code
fixed_login:
.option server_channelbinding gsasl boolean false
Do not set this true and rely on the properties
without consulting a cryptographic engineer.
+. Unsure what that's about. It might be the "Triple Handshake"
+. vulnerability; cf. https://www.mitls.org/pages/attacks/3SHAKE
+. If so, we're ok, requiring Extended Master Secret if TLS
+. Session Resumption was used.
Some authentication mechanisms are able to use external context at both ends
of the session to bind the authentication to that context, and fail the
When more than one address is included in a single delivery (for example, two
SMTP RCPT commands in one transaction) the second and subsequent addresses are
flagged with &`->`& instead of &`=>`&. When two or more messages are delivered
-down a single SMTP connection, an asterisk follows the IP address in the log
-lines for the second and subsequent messages.
+down a single SMTP connection, an asterisk follows the
+.new
+remote IP address (and port if enabled)
+.wen
+in the log lines for the second and subsequent messages.
When two or more messages are delivered down a single TLS connection, the
DNS and some TLS-related information logged for the first message delivered
will not be present in the log lines for the second and subsequent messages.
client's ident port times out.
.next
.cindex "log" "incoming interface"
+.cindex "log" "outgoing interface"
.cindex "log" "local interface"
.cindex "log" "local address and port"
.cindex "TCP/IP" "logging local address and port"
to the &"<="& line as an IP address in square brackets, tagged by I= and
followed by a colon and the port number. The local interface and port are also
added to other SMTP log lines, for example, &"SMTP connection from"&, to
-rejection lines, and (despite the name) to outgoing &"=>"& and &"->"& lines.
+rejection lines, and (despite the name) to outgoing
+.new
+&"=>"&, &"->"&, &"=="& and &"**"& lines.
+.wen
The latter can be disabled by turning off the &%outgoing_interface%& option.
.next
.cindex log "incoming proxy address"
git://git.exim.org / exim.git / blobdiff