.cindex "dsearch lookup type"
The given file must be an absolute directory path; this is searched for an entry
whose name is the key by calling the &[lstat()]& function.
-The key may not contain any forward slash characters.
+.new
+Unless the options (below) permit a path,
+.wen
+the key may not contain any forward slash characters.
If &[lstat()]& succeeds then so does the lookup.
.cindex "tainted data" "dsearch result"
The result is regarded as untainted.
separated by a comma. Options, if present, are a comma-separated list having
each element starting with a tag name and an equals.
-Two options are supported, for the return value and for filtering match
+Three options are supported, for the return value and for filtering match
candidates.
The "ret" option requests an alternate result value of
the entire path for the entry. Example:
${lookup {passwd} dsearch,ret=full {/etc}}
.endd
The default result is just the requested entry.
+
The "filter" option requests that only directory entries of a given type
are matched. The match value is one of "file", "dir" or "subdir" (the latter
not matching "." or ".."). Example:
The default matching is for any entry type, including directories
and symlinks.
+The "key" option relaxes the restriction that only a simple path component can
+be searched for, to permit a sequence of path components. Example:
+.code
+${lookup {foo/bar} dsearch,key=path {/etc}}
+.endd
+If this option is used, a ".." component in the key is specifically disallowed.
+The default operation is that the key may only be a single path component.
+
An example of how this
lookup can be used to support virtual domains is given in section
&<<SECTvirtualdomains>>&.
lookup types support only literal keys.
&*Warning 2*&: In a host list, you must always use &(net-iplsearch)& so that
-the implicit key is the host's IP address rather than its name (see section
-&<<SECThoslispatsikey>>&).
+the implicit key is the host's IP address rather than its name
+(see section &<<SECThoslispatsikey>>&).
&*Warning 3*&: Do not use an IPv4-mapped IPv6 address for a key; use the
IPv4, in dotted-quad form. (Exim converts IPv4-mapped IPv6 addresses to this
anything (for example, setting a field to the value it already has), the result
is zero because no rows are affected.
+.new
+To get an encryted connection, use a Mysql option file with the required
+parameters for the connection.
+.wen
+
.subsection "Special PostgreSQL features" SECID74
PostgreSQL lookups can also use Unix domain socket connections to the database.
&*Reminder*&: With this kind of pattern, you must have host &'names'& as
keys in the file, not IP addresses. If you want to do lookups based on IP
-addresses, you must precede the search type with &"net-"& (see section
-&<<SECThoslispatsikey>>&). There is, however, no reason why you could not use
+addresses, you must precede the search type with &"net-"&
+(see section &<<SECThoslispatsikey>>&).
+There is, however, no reason why you could not use
two items in the same list, one doing an address lookup and one doing a name
lookup, both using the same file.
.next
The item @[] matches any of the local host's interface addresses.
.next
-Single-key lookups are assumed to be like &"net-"& style lookups in host lists,
+Single-key lookups are assumed to be like &"net-"& style lookups in host lists
+(see section &<<SECThoslispatsikey>>&),
even if &`net-`& is not specified. There is never any attempt to turn the IP
address into a host name. The most common type of linear search for
&*match_ip*& is likely to be &*iplsearch*&, in which the file can contain CIDR
.cindex "EHLO" "underscores in"
.cindex "underscore in EHLO/HELO"
This option can be set to a string of rogue characters that are permitted in
-all EHLO and HELO names in addition to the standard letters, digits,
-hyphens, and dots. If you really must allow underscores, you can set
+non-ip-literal EHLO and HELO names in addition to the standard letters, digits,
+hyphens, and dots. For examplem if you really must allow underscores,
+you can set
.code
helo_allow_chars = _
.endd
+This option does not apply to names that look like ip-literals.
Note that the value is one string, not a list.
.subsection General
Under GnuTLS, DANE is only supported from version 3.0.0 onwards.
-DANE is specified in published RFCs and decouples certificate authority trust
+DANE is specified in RFC 6698. It decouples certificate authority trust
selection from a "race to the bottom" of "you must trust everything for mail
to get through".
-There is an alternative technology called MTA-STS, which
-instead publishes MX trust anchor information on an HTTPS website. At the
-time this text was last updated, MTA-STS was still a draft, not yet an RFC.
+It does retain the need to trust the assurances provided by the DNSSEC tree.
+
+There is an alternative technology called MTA-STS (RFC 8461), which
+instead publishes MX trust anchor information on an HTTPS website.
+The discovery of the address for that website does not (per standard)
+require DNSSEC, and could be regarded as being less secure than DANE
+as a result.
+
Exim has no support for MTA-STS as a client, but Exim mail server operators
can choose to publish information describing their TLS configuration using
MTA-STS to let those clients who do use that protocol derive trust
.section "Format of an ACL" "SECID199"
.cindex "&ACL;" "format of"
.cindex "&ACL;" "verbs, definition of"
-An individual ACL consists of a number of statements. Each statement starts
+An individual ACL definition consists of a number of statements.
+Each statement starts
with a verb, optionally followed by a number of conditions and &"modifiers"&.
Modifiers can change the way the verb operates, define error and log messages,
set variables, insert delays, and vary the processing of accepted messages.
all the conditions make sense at every testing point. For example, you cannot
test a sender address in the ACL that is run for a VRFY command.
+The definition of an ACL ends where another starts,
+or a different configuration section starts.
+
.section "ACL verbs" "SECID200"
The ACL verbs are as follows:
allow_fail
data = :fail: Invalid SRS recipient address
- #... further routers here
+ #... further routers here get inbound_srs-redirected recipients
+ # and any that were not SRS'd
# transport; should look like the non-forward outbound
The name is placed in the variable &$event_name$& and the event action
expansion must check this, as it will be called for every possible event type.
+.new
The current list of events is:
+.wen
.itable all 0 0 4 25* left 10* center 15* center 50* left
.row auth:fail after both "per driver per authentication attempt"
.row dane:fail after transport "per connection"
+.row dns:fail after both "per lookup"
.row msg:complete after main "per message"
.row msg:defer after transport "per message per delivery try"
.row msg:delivery after transport "per recipient"
.itable all 0 0 2 20* left 80* left
.row auth:fail "smtp response"
.row dane:fail "failure reason"
+.row dns:fail "failure reason, key and lookup-type"
.row msg:defer "error string"
.row msg:delivery "smtp confirmation message"
.row msg:fail:internal "failure reason"
For OpenSSL it will trigger for every chain element including those
loaded locally.
+.new
+For dns:fail events from dnsdb lookups, a &"defer_never"& option does not
+affect the reporting of DNS_AGAIN.
+.wen
+
. ////////////////////////////////////////////////////////////////////////////
. ////////////////////////////////////////////////////////////////////////////
git://git.exim.org / exim.git / blobdiff