X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/1ed0d29b0be055473fbcc70f1e4c596bd81442f5..1f76af318dd32a1f66d36b9ab5f9e8fe96274dc5:/doc/doc-docbook/spec.xfpt
diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index dfbd7a41a..d839c518a 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -239,6 +239,14 @@
failure report
bounce message
+
+ de-tainting
+ tainting, de-tainting
+
+
+ detainting
+ tainting, de-tainting
+
dialup
intermittently connected hosts
@@ -9606,6 +9614,8 @@ reasons,
and expansion of data deriving from the sender (&"tainted data"&)
.new
is not permitted (including acessing a file using a tainted name).
+The main config option &%allow_insecure_tainted_data%& can be used as
+mitigation during uprades to more secure configurations.
.wen
.new
@@ -14590,6 +14600,7 @@ listed in more than one group.
.section "Miscellaneous" "SECID96"
.table2
.row &%add_environment%& "environment variables"
+.row &%allow_insecure_tainted_data%& "turn taint errors into warnings"
.row &%bi_command%& "to run for &%-bi%& command line option"
.row &%debug_store%& "do extra internal checks"
.row &%disable_ipv6%& "do no IPv6 processing"
@@ -14714,6 +14725,7 @@ listed in more than one group.
.row &%notifier_socket%& "override compiled-in value"
.row &%pid_file_path%& "override compiled-in value"
.row &%queue_run_max%& "maximum simultaneous queue runners"
+.row &%smtp_backlog_monitor%& "level to log listen backlog"
.endtable
@@ -15200,6 +15212,18 @@ domains (defined in the named domain list &%local_domains%& in the default
configuration). This &"magic string"& matches the domain literal form of all
the local host's IP addresses.
+.new
+.option allow_insecure_tainted_data main boolean false
+.cindex "de-tainting"
+.oindex "allow_insecure_tainted_data"
+The handling of tainted data may break older (pre 4.94) configurations.
+Setting this option to "true" turns taint errors (which result in a temporary
+message rejection) into warnings. This option is meant as mitigation only
+and deprecated already today. Future releases of Exim may ignore it.
+The &%taint%& log selector can be used to suppress even the warnings.
+.wen
+
+
.option allow_mx_to_ip main boolean false
.cindex "MX record" "pointing to IP address"
@@ -17732,6 +17756,14 @@ messages, it is also used as the default for HELO commands in callout
verification if there is no remote transport from which to obtain a
&%helo_data%& value.
+.option smtp_backlog_monitor main integer 0
+.cindex "connection backlog" monitoring
+If this option is set to greater than zero, and the backlog of available
+TCP connections on a socket listening for SMTP is larger than it, a line
+is logged giving the value and the socket address and port.
+The value is retrived jsut before an accept call.
+This facility is only available on Linux.
+
.option smtp_banner main string&!! "see below"
.cindex "SMTP" "welcome banner"
.cindex "banner for SMTP"
@@ -17762,7 +17794,7 @@ is zero). If there isn't enough space, a temporary error code is returned.
.option smtp_connect_backlog main integer 20
-.cindex "connection backlog"
+.cindex "connection backlog" "set maximum"
.cindex "SMTP" "connection backlog"
.cindex "backlog of connections"
This option specifies a maximum number of waiting SMTP connections. Exim passes
@@ -18322,7 +18354,7 @@ using the &%tls_certificate%& option. If TLS support for incoming connections
is not required the &%tls_advertise_hosts%& option should be set empty.
-.option tls_certificate main string list&!! unset
+.option tls_certificate main "string list&!!" unset
.cindex "TLS" "server certificate; location of"
.cindex "certificate" "server, location of"
The value of this option is expanded, and must then be a list of absolute paths to
@@ -18533,7 +18565,7 @@ further details, see section &<>&.
-.option tls_privatekey main string list&!! unset
+.option tls_privatekey main "string list&!!" unset
.cindex "TLS" "server private key; location of"
The value of this option is expanded, and must then be a list of absolute paths to
files which contains the server's private keys.
@@ -25271,7 +25303,7 @@ of the message. Its value must not be zero. See also &%final_timeout%&.
.option dkim_canon smtp string&!! unset
DKIM signing option. For details see section &<>&.
-.option dkim_domain smtp string list&!! unset
+.option dkim_domain smtp "string list&!!" unset
DKIM signing option. For details see section &<>&.
.option dkim_hash smtp string&!! sha256
DKIM signing option. For details see section &<>&.
@@ -25632,6 +25664,11 @@ There will be no fallback to in-clear communication.
See the &%dnssec_request_domains%& router and transport options.
See section &<>&.
+.option hosts_require_helo smtp "host list&!!" *
+.cindex "HELO/EHLO" requiring
+Exim will require an accepted HELO or EHLO command from a host matching
+this list, before accepting a MAIL command.
+
.option hosts_require_ocsp smtp "host list&!!" unset
.cindex "TLS" "requiring for certain servers"
Exim will request, and check for a valid Certificate Status being given, on a
@@ -38736,6 +38773,7 @@ selection marked by asterisks:
&` smtp_protocol_error `& SMTP protocol errors
&` smtp_syntax_error `& SMTP syntax errors
&` subject `& contents of &'Subject:'& on <= lines
+&`*taint `& taint errors or warnings
&`*tls_certificate_verified `& certificate verification status
&`*tls_cipher `& TLS cipher suite on <= and => lines
&` tls_peerdn `& TLS peer DN on <= and => lines
@@ -39131,6 +39169,11 @@ using a CA trust anchor,
&`CV=dane`& if using a DNS trust anchor,
and &`CV=no`& if not.
.next
+.cindex "log" "Taint warnings"
+&%taint%&: Log warnings about tainted data. This selector can't be
+turned of if &%allow_insecure_tainted_data%& is false (which is the
+default).
+.next
.cindex "log" "TLS cipher"
.cindex "TLS" "logging cipher"
&%tls_cipher%&: When a message is sent or received over an encrypted
@@ -41693,6 +41736,9 @@ You may deny messages when this occurs.
.vitem &%temperror%&
This indicates a temporary error during all processing, including Exim's
SPF processing. You may defer messages when this occurs.
+
+.vitem &%invalid%&
+There was an error during processing of the SPF lookup
.endlist
You can prefix each string with an exclamation mark to invert
@@ -41740,8 +41786,8 @@ variables:
.vitem &$spf_result$&
.vindex &$spf_result$&
This contains the outcome of the SPF check in string form,
- one of pass, fail, softfail, none, neutral, permerror or
- temperror.
+ currently one of pass, fail, softfail, none, neutral, permerror,
+ temperror, or &"(invalid)"&.
.vitem &$spf_result_guessed$&
.vindex &$spf_result_guessed$&