lookup. Lookups of this type are conditional expansion items. Different results
can be defined for the cases of lookup success and failure. See chapter
&<<CHAPexpand>>&, where string expansions are described in detail.
-The key for the lookup is specified as part of the string expansion.
+The key for the lookup is &*specified*& as part of the string expansion.
.next
Lists of domains, hosts, and email addresses can contain lookup requests as a
way of avoiding excessively long linear lists. In this case, the data that is
returned by the lookup is often (but not always) discarded; whether the lookup
succeeds or fails is what really counts. These kinds of list are described in
chapter &<<CHAPdomhosaddlists>>&.
-The key for the lookup is given by the context in which the list is expanded.
+The key for the lookup is &*implicit*&,
+given by the context in which the list is expanded.
.endlist
String expansions, lists, and lookups interact with each other in such a way
In the second example, the lookup is a single item in a domain list. It causes
Exim to use a lookup to see if the domain that is being processed can be found
-in the file. The file could contains lines like this:
+in the file.
+The file could contains lines like this:
.code
domain1:
domain2:
.cindex "sqlite lookup type"
.cindex "lookup" "sqlite"
&(sqlite)&: The format of the query is
-new
-an optional filename
-followed by an SQL statement
-that is passed to an SQLite database. See section &<<SECTsqlite>>&.
+an SQL statement that is passed to an SQLite database. See section &<<SECTsqlite>>&.
.next
&(testdb)&: This is a lookup type that is used for testing Exim. It is
addition to the SQL query. An SQLite database is a single file, and there is no
daemon as in the other SQL databases.
+.new
.oindex &%sqlite_dbfile%&
-The preferred way of specifying the file is by using the
-&%sqlite_dbfile%& option, set to
-an absolute path.
+There are two ways of
+specifying the file.
+The first is is by using the &%sqlite_dbfile%& main option.
+The second, which allows separate files for each query,
+is to use an option appended, comma-separated, to the &"sqlite"&
+lookup type word. The option is the word &"file"&, then an equals,
+then the filename.
+The filename in this case cannot contain whitespace or open-brace charachters.
+.wen
+
A deprecated method is available, prefixing the query with the filename
separated by white space.
-This means that the path name cannot contain white space.
+This means that
.cindex "tainted data" "sqlite file"
-It also means that the query cannot use any tainted values, as that taints
+the query cannot use any tainted values, as that taints
the entire query including the filename - resulting in a refusal to open
the file.
+In all the above cases the filename must be an absolute path.
+
Here is a lookup expansion example:
.code
sqlite_dbfile = /some/thing/sqlitedb
conditions do not expand some of the brace-delimited branches, for security
reasons,
.cindex "tainted data" expansion
+.cindex "tainted data" definition
.cindex expansion "tainted data"
and expansion of data deriving from the sender (&"tainted data"&)
is not permitted.
+.new
+Common ways of obtaining untainted equivalents of variables with
+tainted values
+.cindex "tainted data" "de-tainting"
+come down to using the tainted value as a lookup key in a trusted database.
+This database could be the filesystem structure,
+or the password file,
+or accessed via a DBMS.
+Specific methods are indexed under &"de-tainting"&.
+.wen
+
.section "Literal text in expanded strings" "SECTlittext"
.wen
-.vitem "&*${lookup{*&<&'key'&>&*}&~*&<&'search&~type'&>&*&~&&&
- {*&<&'file'&>&*}&~{*&<&'string1'&>&*}&~{*&<&'string2'&>&*}}*&"
-This is the first of one of two different types of lookup item, which are both
-described in the next item.
-
-.vitem "&*${lookup&~*&<&'search&~type'&>&*&~{*&<&'query'&>&*}&~&&&
+.vitem "&*${lookup&~{*&<&'key'&>&*}&~*&<&'search&~type'&>&*&~&&&
+ {*&<&'file'&>&*}&~{*&<&'string1'&>&*}&~{*&<&'string2'&>&*}}*&" &&&
+ "&*${lookup&~*&<&'search&~type'&>&*&~{*&<&'query'&>&*}&~&&&
{*&<&'string1'&>&*}&~{*&<&'string2'&>&*}}*&"
.cindex "expansion" "lookup in"
.cindex "file" "lookups"
.cindex "tainted data"
If the origin of the data is an incoming message,
the result of expanding this variable is tainted.
-When un untainted version is needed, one should be obtained from
+When an untainted version is needed, one should be obtained from
looking up the value in a local (therefore trusted) database.
Often &$domain_data$& is usable in this role.
.vindex "&$tls_in_sni$&"
.vindex "&$tls_sni$&"
.cindex "TLS" "Server Name Indication"
+.cindex "TLS" SNI
+.cindex SNI "observability on server"
When a TLS session is being established, if the client sends the Server
Name Indication extension, the value will be placed in this variable.
If the variable appears in &%tls_certificate%& then this option and
.vitem &$tls_out_sni$&
.vindex "&$tls_out_sni$&"
.cindex "TLS" "Server Name Indication"
+.cindex "TLS" SNI
+.cindex SNI "observability in client"
During outbound
SMTP deliveries, this variable reflects the value of the &%tls_sni%& option on
the transport.
.option syslog_timestamp main boolean true
.cindex "syslog" "timestamps"
+.cindex timestamps syslog
If &%syslog_timestamp%& is set false, the timestamps on Exim's log lines are
omitted when these lines are sent to syslog. See chapter &<<CHAPlog>>& for
details of Exim's logging.
file is used, the &$tls_in_ourcert$& variable is unreliable.
The macro "_TLS_BAD_MULTICERT_IN_OURCERT" will be defined for those versions.
+.cindex SNI "selecting server certificate based on"
If the option contains &$tls_out_sni$& and Exim is built against OpenSSL, then
if the OpenSSL build supports TLS extensions and the TLS client sends the
Server Name Indication extension, then this option and others documented in
.option tls_sni smtp string&!! unset
.cindex "TLS" "Server Name Indication"
+.cindex "TLS" SNI
+.cindex SNI "setting in client"
.vindex "&$tls_sni$&"
If this option is set then it sets the $tls_out_sni variable and causes any
TLS session to pass this value as the Server Name Indication extension to
or need not succeed respectively.
The &%tls_verify_cert_hostnames%& option lists hosts for which additional
-checks are made: that the host name (the one in the DNS A record)
-is valid for the certificate.
+name checks are made on the server certificate.
+.new
+The match against this list is, as per other Exim usage, the
+IP for the host. That is most closely associated with the
+name on the DNS A (or AAAA) record for the host.
+However, the name that needs to be in the certificate
+is the one at the head of any CNAME chain leading to the A record.
+.wen
The option defaults to always checking.
The &(smtp)& transport has two OCSP-related options:
.section "Use of TLS Server Name Indication" "SECTtlssni"
.cindex "TLS" "Server Name Indication"
+.cindex "TLS" SNI
+.cindex SNI
.vindex "&$tls_in_sni$&"
.oindex "&%tls_in_sni%&"
With TLS1.0 or above, there is an extension mechanism by which extra
.cindex "header lines" "verifying header names only ASCII"
.cindex "verifying" "header names only ASCII"
This condition is relevant only in an ACL that is run after a message has been
-received, that is, in an ACL specified by &%acl_smtp_data%& or
-&%acl_not_smtp%&. It checks all header names (not the content) to make sure
+received.
+This usually means an ACL specified by &%acl_smtp_data%& or &%acl_not_smtp%&.
+It checks all header names (not the content) to make sure
there are no non-ASCII characters, also excluding control characters. The
allowable characters are decimal ASCII values 33 through 126.
(eg. is generated from the received message)
they must be protected from the options parsing by doubling:
.code
-verify = sender=${sg{${address:$h_sender:}}{/}{//}}
+verify = sender=${listquote{/}{${address:$h_sender:}}}
.endd
.endlist
.next
.cindex "log" "TLS SNI"
.cindex "TLS" "logging SNI"
+.cindex SNI logging
&%tls_sni%&: When a message is received over an encrypted connection, and
the remote host provided the Server Name Indication extension, the SNI is
added to the log line, preceded by SNI=.
git://git.exim.org / exim.git / blobdiff