Support PIPECONNECT with helo_data using the local IP, when interface is known.

[exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 1bc63bff30c98034cbd26bee964489987d7ad152..7f96768f7cde6d92b137daf4ce00268ce6483add 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -6839,6 +6839,12 @@ version of the lookup key.
 The &'query-style'& type accepts a generalized database query. No particular
 key value is assumed by Exim for query-style lookups. You can use whichever
 Exim variables you need to construct the database query.
 The &'query-style'& type accepts a generalized database query. No particular
 key value is assumed by Exim for query-style lookups. You can use whichever
 Exim variables you need to construct the database query.

+.cindex "tainted data" "quoting for lookups"
+.new
+If tainted data is used in the query then it should be quuted by
+using the &*${quote_*&<&'lookup-type'&>&*:*&<&'string'&>&*}*& expansion operator
+appropriate for the lookup.
+.wen

 .endlist
 
 The code for each lookup type is in a separate source file that is included in
 .endlist
 
 The code for each lookup type is in a separate source file that is included in


@@ -6992,7 +6998,7 @@ IPv4, in dotted-quad form. (Exim converts IPv4-mapped IPv6 addresses to this
 notation before executing the lookup.)
 
 One option is supported, "ret=full", to request the return of the entire line
 notation before executing the lookup.)
 
 One option is supported, "ret=full", to request the return of the entire line

-rather than omitting the key porttion.
+rather than omitting the key portion.

 Note however that the key portion will have been de-quoted.
 
 .next
 Note however that the key portion will have been de-quoted.
 
 .next


@@ -10657,16 +10663,28 @@ expansion items.
 This item inserts &"raw"& header lines. It is described with the &%header%&
 expansion item in section &<<SECTexpansionitems>>& above.
 
 This item inserts &"raw"& header lines. It is described with the &%header%&
 expansion item in section &<<SECTexpansionitems>>& above.
 

-.vitem "&*${run{*&<&'command'&>&*&~*&<&'args'&>&*}{*&<&'string1'&>&*}&&&
+.vitem "&*${run <&'options'&> {*&<&'command&~arg&~list'&>&*}{*&<&'string1'&>&*}&&&

         {*&<&'string2'&>&*}}*&"
 .cindex "expansion" "running a command"
 .cindex "&%run%& expansion item"
         {*&<&'string2'&>&*}}*&"
 .cindex "expansion" "running a command"
 .cindex "&%run%& expansion item"

-The command and its arguments are first expanded as one string. The string is
-split apart into individual arguments by spaces, and then the command is run
+This item runs an external command, as a subprocess.
+.new
+One option is supported after the word &'run'&, comma-separated.
+
+If the option &'preexpand'& is not used,
+the command string is split into individual arguments by spaces
+and then each argument is expanded.
+Then the command is run

 in a separate process, but under the same uid and gid.  As in other command
 executions from Exim, a shell is not used by default. If the command requires
 a shell, you must explicitly code it.
 in a separate process, but under the same uid and gid.  As in other command
 executions from Exim, a shell is not used by default. If the command requires
 a shell, you must explicitly code it.

+The command name may not be tainted, but the remaining arguments can be.

 
 

+If the option &'preexpand'& is used,
+.wen
+the command and its arguments are first expanded as one string. The result is
+split apart into individual arguments by spaces, and then the command is run
+as above.

 Since the arguments are split by spaces, when there is a variable expansion
 which has an empty result, it will cause the situation that the argument will
 simply be omitted when the program is actually executed by Exim. If the
 Since the arguments are split by spaces, when there is a variable expansion
 which has an empty result, it will cause the situation that the argument will
 simply be omitted when the program is actually executed by Exim. If the


@@ -10677,6 +10695,9 @@ in a string containing quotes, because it would interfere with the quotes
 around the command arguments. A possible guard against this is to wrap the
 variable in the &%sg%& operator to change any quote marks to some other
 character.
 around the command arguments. A possible guard against this is to wrap the
 variable in the &%sg%& operator to change any quote marks to some other
 character.

+.new
+Neither the command nor any argument may be tainted.
+.wen

 
 The standard input for the command exists, but is empty. The standard output
 and standard error are set to the same file descriptor.
 
 The standard input for the command exists, but is empty. The standard output
 and standard error are set to the same file descriptor.


@@ -11896,6 +11917,19 @@ ${if inlisti{Needle}{fOo:NeeDLE:bAr}}
   ${if forany{fOo:NeeDLE:bAr}{eqi{$item}{Needle}}}
 .endd
 
   ${if forany{fOo:NeeDLE:bAr}{eqi{$item}{Needle}}}
 .endd
 

+.new
+The variable &$value$& will be set for a successful match and can be
+used in the success clause of an &%if%& expansion item using the condition.
+.cindex "tainted data" "de-tainting"
+It will have the same taint status as the list; expansions such as
+.code
+${if inlist {$h_mycode:} {0 : 1 : 42} {$value}}
+.endd
+can be used for de-tainting.
+Any previous &$value$& is restored after the if.
+.wen
+
+

 .vitem &*isip&~{*&<&'string'&>&*}*&  &&&
        &*isip4&~{*&<&'string'&>&*}*& &&&
        &*isip6&~{*&<&'string'&>&*}*&
 .vitem &*isip&~{*&<&'string'&>&*}*&  &&&
        &*isip4&~{*&<&'string'&>&*}*& &&&
        &*isip6&~{*&<&'string'&>&*}*&


@@ -12092,6 +12126,18 @@ item can be used, as in all address lists, to cause subsequent items to
 have their local parts matched casefully. Domains are always matched
 caselessly.
 
 have their local parts matched casefully. Domains are always matched
 caselessly.
 

+.new
+The variable &$value$& will be set for a successful match and can be
+used in the success clause of an &%if%& expansion item using the condition.
+.cindex "tainted data" "de-tainting"
+It will have the same taint status as the list; expansions such as
+.code
+${if match_local_part {$local_part} {alice : bill : charlotte : dave} {$value}}
+.endd
+can be used for de-tainting.
+Any previous &$value$& is restored after the if.
+.wen
+

 Note that <&'string2'&> is not itself subject to string expansion, unless
 Exim was built with the EXPAND_LISTMATCH_RHS option.
 
 Note that <&'string2'&> is not itself subject to string expansion, unless
 Exim was built with the EXPAND_LISTMATCH_RHS option.
 


@@ -25462,7 +25508,8 @@ servers or different local IP addresses. For example, if you want the string
 that is used for &%helo_data%& to be obtained by a DNS lookup of the outgoing
 interface address, you could use this:
 .code
 that is used for &%helo_data%& to be obtained by a DNS lookup of the outgoing
 interface address, you could use this:
 .code

-helo_data = ${lookup dnsdb{ptr=$sending_ip_address}{$value}\
+helo_data = ${lookup dnsdb{ptr=$sending_ip_address} \
+  {${listextract{1}{<\n $value}}} \

   {$primary_hostname}}
 .endd
 The use of &%helo_data%& applies both to sending messages and when doing
   {$primary_hostname}}
 .endd
 The use of &%helo_data%& applies both to sending messages and when doing


@@ -25535,7 +25582,10 @@ so combines well with TCP Fast Open.
 See also the &%pipelining_connect_advertise_hosts%& main option.
 
 Note:
 See also the &%pipelining_connect_advertise_hosts%& main option.
 
 Note:

-When the facility is used, the transport &%helo_data%& option
+.new
+When the facility is used, if the transport &%interface%& option is unset
+the &%helo_data%& option
+.wen

 will be expanded before the &$sending_ip_address$& variable
 is filled in.
 A check is made for the use of that variable, without the
 will be expanded before the &$sending_ip_address$& variable
 is filled in.
 A check is made for the use of that variable, without the


@@ -39416,9 +39466,6 @@ or (in case &*-a*& switch is specified)
 .code
 exim -bp
 .endd
 .code
 exim -bp
 .endd

-The &*-C*& option is used to specify an alternate &_exim.conf_& which might
-contain alternate exim configuration the queue management might be using.
-

 to obtain a queue listing, and then greps the output to select messages
 that match given criteria. The following selection options are available:
 
 to obtain a queue listing, and then greps the output to select messages
 that match given criteria. The following selection options are available:
 


@@ -39475,7 +39522,22 @@ Display messages in reverse order.
 Include delivered recipients in queue listing.
 .endlist
 
 Include delivered recipients in queue listing.
 .endlist
 

+The following options give alternates for configuration:
+
+.vlist
+.vitem &*-C*&&~<&'config&~file'&>
+is used to specify an alternate &_exim.conf_& which might
+contain alternate exim configuration the queue management might be using.
+
+.vitem &*-E*&&~<&'path'&>
+can be used to specify a path for the exim binary,
+overriding the built-in one.
+.endlist
+

 There is one more option, &%-h%&, which outputs a list of options.
 There is one more option, &%-h%&, which outputs a list of options.

+.new
+At least one selection option, or either the &*-c*& or &*-h*& option, must be given.
+.wen

 
 
 
 
 
 


@@ -40994,8 +41056,18 @@ was received, in the conventional Unix form &-- the number of seconds since the
 start of the epoch. The second number is a count of the number of messages
 warning of delayed delivery that have been sent to the sender.
 
 start of the epoch. The second number is a count of the number of messages
 warning of delayed delivery that have been sent to the sender.
 

-There follow a number of lines starting with a hyphen. These can appear in any
-order, and are omitted when not relevant:
+.new
+There follow a number of lines starting with a hyphen.
+These contain variables, can appear in any
+order, and are omitted when not relevant.
+
+If there is a second hyphen after the first,
+the corresponding data is tainted.
+If there is a value in parentheses, the data is quoted for a lookup.
+
+The following word specifies a variable,
+and the remainder of the item depends on the variable.
+.wen

 
 .vlist
 .vitem "&%-acl%&&~<&'number'&>&~<&'length'&>"
 
 .vlist
 .vitem "&%-acl%&&~<&'number'&>&~<&'length'&>"


@@ -41151,9 +41223,6 @@ was received from the client, this records the Distinguished Name from that
 certificate.
 .endlist
 
 certificate.
 .endlist
 

-Any of the above may have an extra hyphen prepended, to indicate the the
-corresponding data is untrusted.
-

 Following the options there is a list of those addresses to which the message
 is not to be delivered. This set of addresses is initialized from the command
 line when the &%-t%& option is used and &%extract_addresses_remove_arguments%&
 Following the options there is a list of those addresses to which the message
 is not to be delivered. This set of addresses is initialized from the command
 line when the &%-t%& option is used and &%extract_addresses_remove_arguments%&