Docs: more resumption notes

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index a7625630ef099207d06216d0b6d5a202be56c168..9f10d17302f3cd19c46a9b7db9b78e471a376739 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -6998,7 +6998,7 @@ IPv4, in dotted-quad form. (Exim converts IPv4-mapped IPv6 addresses to this
 notation before executing the lookup.)
 
 One option is supported, "ret=full", to request the return of the entire line
 notation before executing the lookup.)
 
 One option is supported, "ret=full", to request the return of the entire line

-rather than omitting the key porttion.
+rather than omitting the key portion.

 Note however that the key portion will have been de-quoted.
 
 .next
 Note however that the key portion will have been de-quoted.
 
 .next


@@ -10663,16 +10663,28 @@ expansion items.
 This item inserts &"raw"& header lines. It is described with the &%header%&
 expansion item in section &<<SECTexpansionitems>>& above.
 
 This item inserts &"raw"& header lines. It is described with the &%header%&
 expansion item in section &<<SECTexpansionitems>>& above.
 

-.vitem "&*${run{*&<&'command'&>&*&~*&<&'args'&>&*}{*&<&'string1'&>&*}&&&
+.vitem "&*${run <&'options'&> {*&<&'command&~arg&~list'&>&*}{*&<&'string1'&>&*}&&&

         {*&<&'string2'&>&*}}*&"
 .cindex "expansion" "running a command"
 .cindex "&%run%& expansion item"
         {*&<&'string2'&>&*}}*&"
 .cindex "expansion" "running a command"
 .cindex "&%run%& expansion item"

-The command and its arguments are first expanded as one string. The string is
-split apart into individual arguments by spaces, and then the command is run
+This item runs an external command, as a subprocess.
+.new
+One option is supported after the word &'run'&, comma-separated.
+
+If the option &'preexpand'& is not used,
+the command string is split into individual arguments by spaces
+and then each argument is expanded.
+Then the command is run

 in a separate process, but under the same uid and gid.  As in other command
 executions from Exim, a shell is not used by default. If the command requires
 a shell, you must explicitly code it.
 in a separate process, but under the same uid and gid.  As in other command
 executions from Exim, a shell is not used by default. If the command requires
 a shell, you must explicitly code it.

+The command name may not be tainted, but the remaining arguments can be.

 
 

+If the option &'preexpand'& is used,
+.wen
+the command and its arguments are first expanded as one string. The result is
+split apart into individual arguments by spaces, and then the command is run
+as above.

 Since the arguments are split by spaces, when there is a variable expansion
 which has an empty result, it will cause the situation that the argument will
 simply be omitted when the program is actually executed by Exim. If the
 Since the arguments are split by spaces, when there is a variable expansion
 which has an empty result, it will cause the situation that the argument will
 simply be omitted when the program is actually executed by Exim. If the


@@ -10683,6 +10695,9 @@ in a string containing quotes, because it would interfere with the quotes
 around the command arguments. A possible guard against this is to wrap the
 variable in the &%sg%& operator to change any quote marks to some other
 character.
 around the command arguments. A possible guard against this is to wrap the
 variable in the &%sg%& operator to change any quote marks to some other
 character.

+.new
+Neither the command nor any argument may be tainted.
+.wen

 
 The standard input for the command exists, but is empty. The standard output
 and standard error are set to the same file descriptor.
 
 The standard input for the command exists, but is empty. The standard output
 and standard error are set to the same file descriptor.


@@ -11902,6 +11917,19 @@ ${if inlisti{Needle}{fOo:NeeDLE:bAr}}
   ${if forany{fOo:NeeDLE:bAr}{eqi{$item}{Needle}}}
 .endd
 
   ${if forany{fOo:NeeDLE:bAr}{eqi{$item}{Needle}}}
 .endd
 

+.new
+The variable &$value$& will be set for a successful match and can be
+used in the success clause of an &%if%& expansion item using the condition.
+.cindex "tainted data" "de-tainting"
+It will have the same taint status as the list; expansions such as
+.code
+${if inlist {$h_mycode:} {0 : 1 : 42} {$value}}
+.endd
+can be used for de-tainting.
+Any previous &$value$& is restored after the if.
+.wen
+
+

 .vitem &*isip&~{*&<&'string'&>&*}*&  &&&
        &*isip4&~{*&<&'string'&>&*}*& &&&
        &*isip6&~{*&<&'string'&>&*}*&
 .vitem &*isip&~{*&<&'string'&>&*}*&  &&&
        &*isip4&~{*&<&'string'&>&*}*& &&&
        &*isip6&~{*&<&'string'&>&*}*&


@@ -12098,6 +12126,18 @@ item can be used, as in all address lists, to cause subsequent items to
 have their local parts matched casefully. Domains are always matched
 caselessly.
 
 have their local parts matched casefully. Domains are always matched
 caselessly.
 

+.new
+The variable &$value$& will be set for a successful match and can be
+used in the success clause of an &%if%& expansion item using the condition.
+.cindex "tainted data" "de-tainting"
+It will have the same taint status as the list; expansions such as
+.code
+${if match_local_part {$local_part} {alice : bill : charlotte : dave} {$value}}
+.endd
+can be used for de-tainting.
+Any previous &$value$& is restored after the if.
+.wen
+

 Note that <&'string2'&> is not itself subject to string expansion, unless
 Exim was built with the EXPAND_LISTMATCH_RHS option.
 
 Note that <&'string2'&> is not itself subject to string expansion, unless
 Exim was built with the EXPAND_LISTMATCH_RHS option.
 


@@ -25468,12 +25508,45 @@ servers or different local IP addresses. For example, if you want the string
 that is used for &%helo_data%& to be obtained by a DNS lookup of the outgoing
 interface address, you could use this:
 .code
 that is used for &%helo_data%& to be obtained by a DNS lookup of the outgoing
 interface address, you could use this:
 .code

-helo_data = ${lookup dnsdb{ptr=$sending_ip_address}{$value}\
+helo_data = ${lookup dnsdb{ptr=$sending_ip_address} \
+  {${listextract{1}{<\n $value}}} \

   {$primary_hostname}}
 .endd
 The use of &%helo_data%& applies both to sending messages and when doing
 callouts.
 
   {$primary_hostname}}
 .endd
 The use of &%helo_data%& applies both to sending messages and when doing
 callouts.
 

+.new
+.option host_name_extract smtp "string list&!!" "see below"
+.cindex "load balancer" "hosts behind"
+.cindex TLS resumption
+Some mail-accepting sites
+(notably Microsoft)
+operate many servers behind a network load-balancer.  When this is done,
+with separated TLS session caches, TLS session resuption becomes problematic.
+It will only succeed when the same server happens to be selected by the
+load-balancer, matching the session stored in the client's cache.
+
+Exim can pull out a server name, if there is one, from the response to the
+client's SMTP EHLO command.
+The default value of this option:
+.code
+    ${if and { {match {$host} {.outlook.com\$}} \
+               {match {$item} {\N^250-([\w.]+)\s\N}} \
+            } {$1}}
+.endd
+suffices for one known case.
+During the expansion of this option the &$item$& variable will have the
+server's EHLO response.
+The result of the option expansion is included in the key used to store and
+retrieve the TLS session, for session resumption.
+
+Operators of high-load sites may wish to evaluate their logs for indications
+of other destination sites operating load-balancers, and develop a suitable
+expression for this option.
+The smtp:ehlo event and the &$tls_out_resumption$& variable
+will be useful for such work.
+.wen
+

 .option hosts smtp "string list&!!" unset
 Hosts are associated with an address by a router such as &(dnslookup)&, which
 finds the hosts by looking up the address domain in the DNS, or by
 .option hosts smtp "string list&!!" unset
 Hosts are associated with an address by a router such as &(dnslookup)&, which
 finds the hosts by looking up the address domain in the DNS, or by


@@ -25541,7 +25614,10 @@ so combines well with TCP Fast Open.
 See also the &%pipelining_connect_advertise_hosts%& main option.
 
 Note:
 See also the &%pipelining_connect_advertise_hosts%& main option.
 
 Note:

-When the facility is used, the transport &%helo_data%& option
+.new
+When the facility is used, if the transport &%interface%& option is unset
+the &%helo_data%& option
+.wen

 will be expanded before the &$sending_ip_address$& variable
 is filled in.
 A check is made for the use of that variable, without the
 will be expanded before the &$sending_ip_address$& variable
 is filled in.
 A check is made for the use of that variable, without the


@@ -29817,8 +29893,10 @@ nothing more to it.  Choosing a sensible value not derived insecurely is the
 only point of caution.  The &$tls_out_sni$& variable will be set to this string
 for the lifetime of the client connection (including during authentication).
 
 only point of caution.  The &$tls_out_sni$& variable will be set to this string
 for the lifetime of the client connection (including during authentication).
 

+.new

 If DANE validated the connection attempt then the value of the &%tls_sni%& option
 If DANE validated the connection attempt then the value of the &%tls_sni%& option

-is forced to the domain part of the recipient address.
+is forced to the name of the destination host, after any MX- or CNAME-following.
+.wen

 
 Except during SMTP client sessions, if &$tls_in_sni$& is set then it is a string
 received from a client.
 
 Except during SMTP client sessions, if &$tls_in_sni$& is set then it is a string
 received from a client.


@@ -39481,7 +39559,7 @@ Include delivered recipients in queue listing.
 The following options give alternates for configuration:
 
 .vlist
 The following options give alternates for configuration:
 
 .vlist

-.vitem &*-C*&&~<&'config file'&>
+.vitem &*-C*&&~<&'config&~file'&>

 is used to specify an alternate &_exim.conf_& which might
 contain alternate exim configuration the queue management might be using.
 
 is used to specify an alternate &_exim.conf_& which might
 contain alternate exim configuration the queue management might be using.
 


@@ -39878,8 +39956,9 @@ The entire contents of a database are written to the standard output by the
 &'exim_dumpdb'& program,
 .new
 taking as arguments the spool and database names.
 &'exim_dumpdb'& program,
 .new
 taking as arguments the spool and database names.

-An option &'-z'& may be given to regest times in UTC;
+An option &'-z'& may be given to request times in UTC;

 otherwise times are in the local timezone.
 otherwise times are in the local timezone.

+An option &'-k'& may be given to dump only the record keys.

 .wen
 For example, to dump the retry database:
 .code
 .wen
 For example, to dump the retry database:
 .code