X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/1ed0d29b0be055473fbcc70f1e4c596bd81442f5..1f76af318dd32a1f66d36b9ab5f9e8fe96274dc5:/doc/doc-docbook/spec.xfpt diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index dfbd7a41a..d839c518a 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -239,6 +239,14 @@ failure report bounce message + + de-tainting + tainting, de-tainting + + + detainting + tainting, de-tainting + dialup intermittently connected hosts @@ -9606,6 +9614,8 @@ reasons, and expansion of data deriving from the sender (&"tainted data"&) .new is not permitted (including acessing a file using a tainted name). +The main config option &%allow_insecure_tainted_data%& can be used as +mitigation during uprades to more secure configurations. .wen .new @@ -14590,6 +14600,7 @@ listed in more than one group. .section "Miscellaneous" "SECID96" .table2 .row &%add_environment%& "environment variables" +.row &%allow_insecure_tainted_data%& "turn taint errors into warnings" .row &%bi_command%& "to run for &%-bi%& command line option" .row &%debug_store%& "do extra internal checks" .row &%disable_ipv6%& "do no IPv6 processing" @@ -14714,6 +14725,7 @@ listed in more than one group. .row &%notifier_socket%& "override compiled-in value" .row &%pid_file_path%& "override compiled-in value" .row &%queue_run_max%& "maximum simultaneous queue runners" +.row &%smtp_backlog_monitor%& "level to log listen backlog" .endtable @@ -15200,6 +15212,18 @@ domains (defined in the named domain list &%local_domains%& in the default configuration). This &"magic string"& matches the domain literal form of all the local host's IP addresses. +.new +.option allow_insecure_tainted_data main boolean false +.cindex "de-tainting" +.oindex "allow_insecure_tainted_data" +The handling of tainted data may break older (pre 4.94) configurations. +Setting this option to "true" turns taint errors (which result in a temporary +message rejection) into warnings. This option is meant as mitigation only +and deprecated already today. Future releases of Exim may ignore it. +The &%taint%& log selector can be used to suppress even the warnings. +.wen + + .option allow_mx_to_ip main boolean false .cindex "MX record" "pointing to IP address" @@ -17732,6 +17756,14 @@ messages, it is also used as the default for HELO commands in callout verification if there is no remote transport from which to obtain a &%helo_data%& value. +.option smtp_backlog_monitor main integer 0 +.cindex "connection backlog" monitoring +If this option is set to greater than zero, and the backlog of available +TCP connections on a socket listening for SMTP is larger than it, a line +is logged giving the value and the socket address and port. +The value is retrived jsut before an accept call. +This facility is only available on Linux. + .option smtp_banner main string&!! "see below" .cindex "SMTP" "welcome banner" .cindex "banner for SMTP" @@ -17762,7 +17794,7 @@ is zero). If there isn't enough space, a temporary error code is returned. .option smtp_connect_backlog main integer 20 -.cindex "connection backlog" +.cindex "connection backlog" "set maximum" .cindex "SMTP" "connection backlog" .cindex "backlog of connections" This option specifies a maximum number of waiting SMTP connections. Exim passes @@ -18322,7 +18354,7 @@ using the &%tls_certificate%& option. If TLS support for incoming connections is not required the &%tls_advertise_hosts%& option should be set empty. -.option tls_certificate main string list&!! unset +.option tls_certificate main "string list&!!" unset .cindex "TLS" "server certificate; location of" .cindex "certificate" "server, location of" The value of this option is expanded, and must then be a list of absolute paths to @@ -18533,7 +18565,7 @@ further details, see section &<>&. -.option tls_privatekey main string list&!! unset +.option tls_privatekey main "string list&!!" unset .cindex "TLS" "server private key; location of" The value of this option is expanded, and must then be a list of absolute paths to files which contains the server's private keys. @@ -25271,7 +25303,7 @@ of the message. Its value must not be zero. See also &%final_timeout%&. .option dkim_canon smtp string&!! unset DKIM signing option. For details see section &<>&. -.option dkim_domain smtp string list&!! unset +.option dkim_domain smtp "string list&!!" unset DKIM signing option. For details see section &<>&. .option dkim_hash smtp string&!! sha256 DKIM signing option. For details see section &<>&. @@ -25632,6 +25664,11 @@ There will be no fallback to in-clear communication. See the &%dnssec_request_domains%& router and transport options. See section &<>&. +.option hosts_require_helo smtp "host list&!!" * +.cindex "HELO/EHLO" requiring +Exim will require an accepted HELO or EHLO command from a host matching +this list, before accepting a MAIL command. + .option hosts_require_ocsp smtp "host list&!!" unset .cindex "TLS" "requiring for certain servers" Exim will request, and check for a valid Certificate Status being given, on a @@ -38736,6 +38773,7 @@ selection marked by asterisks: &` smtp_protocol_error `& SMTP protocol errors &` smtp_syntax_error `& SMTP syntax errors &` subject `& contents of &'Subject:'& on <= lines +&`*taint `& taint errors or warnings &`*tls_certificate_verified `& certificate verification status &`*tls_cipher `& TLS cipher suite on <= and => lines &` tls_peerdn `& TLS peer DN on <= and => lines @@ -39131,6 +39169,11 @@ using a CA trust anchor, &`CV=dane`& if using a DNS trust anchor, and &`CV=no`& if not. .next +.cindex "log" "Taint warnings" +&%taint%&: Log warnings about tainted data. This selector can't be +turned of if &%allow_insecure_tainted_data%& is false (which is the +default). +.next .cindex "log" "TLS cipher" .cindex "TLS" "logging cipher" &%tls_cipher%&: When a message is sent or received over an encrypted @@ -41693,6 +41736,9 @@ You may deny messages when this occurs. .vitem &%temperror%& This indicates a temporary error during all processing, including Exim's SPF processing. You may defer messages when this occurs. + +.vitem &%invalid%& +There was an error during processing of the SPF lookup .endlist You can prefix each string with an exclamation mark to invert @@ -41740,8 +41786,8 @@ variables: .vitem &$spf_result$& .vindex &$spf_result$& This contains the outcome of the SPF check in string form, - one of pass, fail, softfail, none, neutral, permerror or - temperror. + currently one of pass, fail, softfail, none, neutral, permerror, + temperror, or &"(invalid)"&. .vitem &$spf_result_guessed$& .vindex &$spf_result_guessed$&