+.new
+.subsection "The ATRN command, and ODMR" SECTODMR
+.cindex ATRN processing
+.cindex "ESMTP extensions" ATRN
+.cindex ODMR provider
+A second method for handling
+On-Demand Message Reception (ODMR)
+for intermittently-connecting destinations is specified by
+&url(https://www.rfc-editor.org/rfc/rfc2645.html,RFC 2645).
+
+This describes an ESMTP command called ATRN which requests
+a swap in server/client roles of the communicating SMTP endpoints,
+and delivery of queued messages.
+Note that this supports customers having IP addresses that
+change frequently.
+
+Exim supports both the &"provider"& and &"customer"& sides of ODMR,
+to use the terms of that specification.
+
+. need a sub-subsection here
+.subsection "ODMR provider connection" SECTODMRPRDVR
+
+In the &"provider"& use case Exim is
+initially an SMTP server, then transferring to an SMTP client
+role if an ATRN command is accepted.
+
+.oindex "&%acl_smtp_atrn%&"
+The command is only available if permitted by an ACL
+specfied by the main-section &%acl_smtp_atrn%& option.
+Per the standard, this should only be for a specific
+provider port number (386, named "odmr");
+Exim should be configured to listen on that port
+(in addition to other duties) via &%daemon_smtp_ports%&
+or equivalent commandline options, and restrict the
+advertising of the facility to the port:
+.code
+acl_smtp_atrn = ${if = {$received_port}{386} {check_atrn}{}}
+.endd
+
+A recieved ATRN command will be rejected unless
+authentication has previously been done on the connection.
+
+Any arguments supplied with an ATRN command are (per standard)
+a comma-separated list of requested domains,
+and will be available in the &$smtp_command_argument$&
+variable.
+
+The ACL configured may return &"deny"& for any policy reaons
+(for example, the authenticated user is not permitted the facility).
+Otherwise it should use the ACL &"atrn_domains"& condition,
+which returns true if there are queued messages for any of
+the given list of domains.
+If that condition fails the ACL should return &"defer"&
+with a "453 You have no mail" response;
+else it should return &"accept"&.
+
+For example (with default domain handling, and one possible de-taint method) :
+.code
+check_atrn:
+ warn set acl_m0 = clientdom.net
+ deny condition = ${if def:smtp_command_argument}
+ set acl_m0 = ${map \
+ {<, $smtp_command_argument} \
+ {${if inlist{$item}{clientdom.net:cl2dom.net} {$value}}} \
+ }
+ condition = ${if !def:acl_m0}
+ defer !atrn_domains = <, $acl_m0
+ message = 453 You have no mail
+ accept
+.endd
+
+Acceptance by the ACL will result in a queue-run for messages
+having addresses with the given domains.
+A suitable router and transport must be configured for the deliveries.
+
+To access a named queue
+.cindex queue named
+the ACL should use a "queue =" modifier before the "atrn_domains"
+condition.
+If the ACL does not accept, re-set the queue to an empty value
+so as to not disrupt any later SMTP operations on the connection.
+
+Use of the &"atrn_domains"& condition additionally sets up
+the &$atrn_host$& variable, which can be used by a manualroute
+router. Being otherwise empty, this router will decline in
+other situations so can be safely placed in a general router chain.
+
+For example:
+.code
+begin routers
+to_odmr_customer:
+ driver = manualroute
+ route_data = <;$atrn_host
+ transport = call_customer
+
+begin transports
+call_customer:
+ driver = smtp
+.endd
+
+Although not discssed in the specification document,
+Exim supports use of ATRN within a STARTTLS-
+or TLS-on-connect- encrypted connection
+(which is wise if a plaintext authentication mechanism is used).
+In such cases the TLS connection will remain open across the
+role-swap, and be used for the sending of queued messages.
+
+Note that the RFC requires that the CRAM-MD5 authentication
+method be supported.
+Exim does not enforce this, but leaves it up to the configuration;
+see chapter &<<CHID9>>&.
+
+
+.subsection "ODMR customer connection" SECTODMRCUST
+.cindex ODMR customer
+Exim supports the &"customer"& side of ODMR,
+with a command-line option &"-atrn"& that requests a connection
+to a given host, issuance of an ATRN command then operation
+in SMTP server mode.
+The option must be followed by two arguments.
+
+The first is the name or IP of the provider to be contacted.
+
+The second, which may be empty, should be a comma-separated list
+of domains for which mail is to be requested.
+Interpretation of the list is up to the provider;
+an empty list is expected to result in some default being returned.
+
+The provider host is placed in &$domain$& for routing;
+router and transport must be configured suitably to make the connection.
+For example:
+.code
+begin routers
+to_odmr_provider:
+ driver = manualroute
+ condition = ${if eq {$atrn_mode}{C}}
+ route_data = <;$domain
+ transport = call_provider
+
+begin transports
+call_provider:
+ driver = smtp
+ port = odmr
+ hosts_try_auth = *
+ command_timeout = 10m
+.endd
+
+Note that the specification requires a long timeout for the ATRN
+command, to allow for scanning of queued messages.
+
+Configuration should also include client-side authentication
+and processing for receiving messages.
+.wen
+
+
git://git.exim.org / exim.git / blobdiff