When the lookup succeeds, the result of the expansion is a list of domains (and
possibly other types of item that are allowed in domain lists).
.cindex "tainted data" "de-tainting"
-.cindex "de-tainting" "using a lookup expansion""
+.cindex "de-tainting" "using a lookup expansion"
The result of the expansion is not tainted.
.next
default, but the separator can be changed in the usual way (&<<SECTlistsepchange>>&).
For each item
in this list, its value is place in &$item$&, and then the condition is
-evaluated. If the condition is true, &$item$& is added to the output as an
+evaluated.
+.new
+Any modification of &$value$& by this evaluation is discarded.
+.wen
+If the condition is true, &$item$& is added to the output as an
item in a new list; if the condition is false, the item is discarded. The
separator used for the output list is the same as the one used for the
input, but a separator setting is not included in the output. For example:
${filter{a:b:c}{!eq{$item}{b}}}
.endd
yields &`a:c`&. At the end of the expansion, the value of &$item$& is restored
-to what it was before. See also the &%map%& and &%reduce%& expansion items.
+to what it was before.
+See also the &%map%& and &%reduce%& expansion items.
.vitem &*${hash{*&<&'string1'&>&*}{*&<&'string2'&>&*}{*&<&'string3'&>&*}}*&
restored to what they were before. See also the &%filter%& and &%map%&
expansion items.
+. A bit of a special-case logic error in writing an expansion;
+. probably not worth including in the mainline of documentation.
+. If only we had footnotes (the html output variant is the problem).
+.
+. .new
+. &*Note*&: if an &'expansion condition'& is used in <&'string3'&>
+. and that condition modifies &$value$&,
+. then the string expansions dependent on the condition cannot use
+. the &$value$& of the reduce iteration.
+. .wen
+
.vitem &*$rheader_*&<&'header&~name'&>&*:*&&~or&~&*$rh_*&<&'header&~name'&>&*:*&
This item inserts &"raw"& header lines. It is described with the &%header%&
expansion item in section &<<SECTexpansionitems>>& above.
.cindex "host" "rejecting connections from"
If this option is set, incoming SMTP calls from the hosts listed are rejected
as soon as the connection is made.
-This option is obsolete, and retained only for backward compatibility, because
+This option is mostly obsolete, retained for backward compatibility because
nowadays the ACL specified by &%acl_smtp_connect%& can also reject incoming
-connections immediately.
+connections immediately
+.new
+(except for tls-on-connect connections).
+.wen
The ability to give an immediate rejection (either by this option or using an
ACL) is provided for use in unusual cases. Many hosts will just try again,
&<<CHAPSMTPAUTH>>& for details of authentication.
-.option hosts_request_ocsp smtp "host list&!!" *
+.option hosts_request_ocsp smtp "host list&!!" "see below"
.cindex "TLS" "requiring for certain servers"
Exim will request a Certificate Status on a
TLS session for any host that matches this list.
&%tls_verify_certificates%& should also be set for the transport.
+.new
+The default is &"**"& if DANE is not in use for the connection,
+or if DANE-TA us used.
+It is empty if DANE-EE is used.
+.wen
+
.option hosts_require_alpn smtp "host list&!!" unset
.cindex ALPN "require negotiation in client"
.cindex TLS ALPN
operation is as if this option selected all hosts.
&*Warning*&: Including a host in &%tls_verify_hosts%& does not require
that connections use TLS.
-Fallback to in-clear communication will be done unless restricted by
+Fallback to in-clear communication will be done unless restricted by
the &%hosts_require_tls%& option.
.option utf8_downconvert smtp integer&!! -1
The client for the connection proposes a set of protocol names, and
the server responds with a selected one.
It is not, as of 2021, commonly used for SMTP connections.
-However, to guard against misirected or malicious use of web clients
+However, to guard against misdirected or malicious use of web clients
(which often do use ALPN) against MTA ports, Exim by default check that
there is no incompatible ALPN specified by a client for a TLS connection.
If there is, the connection is rejected.
&%tls_alpn%& and &%hosts_require_alpn%&.
There are no variables providing observability.
Some feature-specific logging may appear on denied connections, but this
-depends on the behavious of the peer
+depends on the behaviour of the peer
(not all peers can send a feature-specific TLS Alert).
This feature is available when Exim is built with
immediate writes to file are done as normal.
trigger=<&'reason'&> This option selects cause for the pretrigger buffer
- see above) to be copied to file. A reason of $*now*
+ see above) to be copied to file. A reason of &*now*&
take effect immediately; one of &*paniclog*& triggers
on a write to the panic log.
.endd
.subsection ACL SSECDMARCACL
.cindex DMARC "ACL condition"
-DMARC checks cam be run on incoming SMTP messages by using the
+DMARC checks can be run on incoming SMTP messages by using the
&"dmarc_status"& ACL condition in the DATA ACL. You are required to
call the &"spf"& condition first in the ACLs, then the &"dmarc_status"&
condition. Putting this condition in the ACLs is required in order
git://git.exim.org / exim.git / blobdiff