X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/45329490797bbaf91000dfa992a97a811f306b70..96630700fa134520d4595e8add238dae5a2816c6:/doc/doc-docbook/spec.xfpt
diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 6ede1dc95..f7cc50534 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -239,14 +239,6 @@
failure report
bounce message
-
- de-tainting
- tainting, de-tainting
-
-
- detainting
- tainting, de-tainting
-
dialup
intermittently connected hosts
@@ -6847,6 +6839,12 @@ version of the lookup key.
The &'query-style'& type accepts a generalized database query. No particular
key value is assumed by Exim for query-style lookups. You can use whichever
Exim variables you need to construct the database query.
+.cindex "tainted data" "quoting for lookups"
+.new
+If tainted data is used in the query then it should be quuted by
+using the &*${quote_*&<&'lookup-type'&>&*:*&<&'string'&>&*}*& expansion operator
+appropriate for the lookup.
+.wen
.endlist
The code for each lookup type is in a separate source file that is included in
@@ -7000,7 +6998,7 @@ IPv4, in dotted-quad form. (Exim converts IPv4-mapped IPv6 addresses to this
notation before executing the lookup.)
One option is supported, "ret=full", to request the return of the entire line
-rather than omitting the key porttion.
+rather than omitting the key portion.
Note however that the key portion will have been de-quoted.
.next
@@ -9628,8 +9626,6 @@ reasons,
.cindex expansion "tainted data"
and expansion of data deriving from the sender (&"tainted data"&)
is not permitted (including acessing a file using a tainted name).
-The main config option &%allow_insecure_tainted_data%& can be used as
-mitigation during uprades to more secure configurations.
Common ways of obtaining untainted equivalents of variables with
tainted values
@@ -10667,16 +10663,28 @@ expansion items.
This item inserts &"raw"& header lines. It is described with the &%header%&
expansion item in section &<>& above.
-.vitem "&*${run{*&<&'command'&>&*&~*&<&'args'&>&*}{*&<&'string1'&>&*}&&&
+.vitem "&*${run <&'options'&> {*&<&'command&~arg&~list'&>&*}{*&<&'string1'&>&*}&&&
{*&<&'string2'&>&*}}*&"
.cindex "expansion" "running a command"
.cindex "&%run%& expansion item"
-The command and its arguments are first expanded as one string. The string is
-split apart into individual arguments by spaces, and then the command is run
+This item runs an external command, as a subprocess.
+.new
+One option is supported after the word &'run'&, comma-separated.
+
+If the option &'preexpand'& is not used,
+the command string is split into individual arguments by spaces
+and then each argument is expanded.
+Then the command is run
in a separate process, but under the same uid and gid. As in other command
executions from Exim, a shell is not used by default. If the command requires
a shell, you must explicitly code it.
+The command name may not be tainted, but the remaining arguments can be.
+If the option &'preexpand'& is used,
+.wen
+the command and its arguments are first expanded as one string. The result is
+split apart into individual arguments by spaces, and then the command is run
+as above.
Since the arguments are split by spaces, when there is a variable expansion
which has an empty result, it will cause the situation that the argument will
simply be omitted when the program is actually executed by Exim. If the
@@ -10687,6 +10695,9 @@ in a string containing quotes, because it would interfere with the quotes
around the command arguments. A possible guard against this is to wrap the
variable in the &%sg%& operator to change any quote marks to some other
character.
+.new
+Neither the command nor any argument may be tainted.
+.wen
The standard input for the command exists, but is empty. The standard output
and standard error are set to the same file descriptor.
@@ -11906,6 +11917,19 @@ ${if inlisti{Needle}{fOo:NeeDLE:bAr}}
${if forany{fOo:NeeDLE:bAr}{eqi{$item}{Needle}}}
.endd
+.new
+The variable &$value$& will be set for a successful match and can be
+used in the success clause of an &%if%& expansion item using the condition.
+.cindex "tainted data" "de-tainting"
+It will have the same taint status as the list; expansions such as
+.code
+${if inlist {$h_mycode:} {0 : 1 : 42} {$value}}
+.endd
+can be used for de-tainting.
+Any previous &$value$& is restored after the if.
+.wen
+
+
.vitem &*isip&~{*&<&'string'&>&*}*& &&&
&*isip4&~{*&<&'string'&>&*}*& &&&
&*isip6&~{*&<&'string'&>&*}*&
@@ -12102,6 +12126,18 @@ item can be used, as in all address lists, to cause subsequent items to
have their local parts matched casefully. Domains are always matched
caselessly.
+.new
+The variable &$value$& will be set for a successful match and can be
+used in the success clause of an &%if%& expansion item using the condition.
+.cindex "tainted data" "de-tainting"
+It will have the same taint status as the list; expansions such as
+.code
+${if match_local_part {$local_part} {alice : bill : charlotte : dave} {$value}}
+.endd
+can be used for de-tainting.
+Any previous &$value$& is restored after the if.
+.wen
+
Note that <&'string2'&> is not itself subject to string expansion, unless
Exim was built with the EXPAND_LISTMATCH_RHS option.
@@ -14609,7 +14645,6 @@ listed in more than one group.
.section "Miscellaneous" "SECID96"
.table2
.row &%add_environment%& "environment variables"
-.row &%allow_insecure_tainted_data%& "turn taint errors into warnings"
.row &%bi_command%& "to run for &%-bi%& command line option"
.row &%debug_store%& "do extra internal checks"
.row &%disable_ipv6%& "do no IPv6 processing"
@@ -15223,17 +15258,6 @@ domains (defined in the named domain list &%local_domains%& in the default
configuration). This &"magic string"& matches the domain literal form of all
the local host's IP addresses.
-.option allow_insecure_tainted_data main boolean false
-.cindex "de-tainting"
-.oindex "allow_insecure_tainted_data"
-The handling of tainted data may break older (pre 4.94) configurations.
-Setting this option to "true" turns taint errors (which result in a temporary
-message rejection) into warnings. This option is meant as mitigation only
-and deprecated already today. Future releases of Exim may ignore it.
-The &%taint%& log selector can be used to suppress even the warnings.
-
-
-
.option allow_mx_to_ip main boolean false
.cindex "MX record" "pointing to IP address"
It appears that more and more DNS zone administrators are breaking the rules
@@ -25484,7 +25508,8 @@ servers or different local IP addresses. For example, if you want the string
that is used for &%helo_data%& to be obtained by a DNS lookup of the outgoing
interface address, you could use this:
.code
-helo_data = ${lookup dnsdb{ptr=$sending_ip_address}{$value}\
+helo_data = ${lookup dnsdb{ptr=$sending_ip_address} \
+ {${listextract{1}{<\n $value}}} \
{$primary_hostname}}
.endd
The use of &%helo_data%& applies both to sending messages and when doing
@@ -25557,7 +25582,10 @@ so combines well with TCP Fast Open.
See also the &%pipelining_connect_advertise_hosts%& main option.
Note:
-When the facility is used, the transport &%helo_data%& option
+.new
+When the facility is used, if the transport &%interface%& option is unset
+the &%helo_data%& option
+.wen
will be expanded before the &$sending_ip_address$& variable
is filled in.
A check is made for the use of that variable, without the
@@ -29833,8 +29861,10 @@ nothing more to it. Choosing a sensible value not derived insecurely is the
only point of caution. The &$tls_out_sni$& variable will be set to this string
for the lifetime of the client connection (including during authentication).
+.new
If DANE validated the connection attempt then the value of the &%tls_sni%& option
-is forced to the domain part of the recipient address.
+is forced to the name of the destination host, after any MX- or CNAME-folowing.
+.wen
Except during SMTP client sessions, if &$tls_in_sni$& is set then it is a string
received from a client.
@@ -38901,7 +38931,6 @@ selection marked by asterisks:
&` smtp_protocol_error `& SMTP protocol errors
&` smtp_syntax_error `& SMTP syntax errors
&` subject `& contents of &'Subject:'& on <= lines
-&`*taint `& taint errors or warnings
&`*tls_certificate_verified `& certificate verification status
&`*tls_cipher `& TLS cipher suite on <= and => lines
&` tls_peerdn `& TLS peer DN on <= and => lines
@@ -39295,11 +39324,6 @@ using a CA trust anchor,
&`CV=dane`& if using a DNS trust anchor,
and &`CV=no`& if not.
.next
-.cindex "log" "Taint warnings"
-&%taint%&: Log warnings about tainted data. This selector can't be
-turned of if &%allow_insecure_tainted_data%& is false (which is the
-default).
-.next
.cindex "log" "TLS cipher"
.cindex "TLS" "logging cipher"
&%tls_cipher%&: When a message is sent or received over an encrypted
@@ -39444,9 +39468,6 @@ or (in case &*-a*& switch is specified)
.code
exim -bp
.endd
-The &*-C*& option is used to specify an alternate &_exim.conf_& which might
-contain alternate exim configuration the queue management might be using.
-
to obtain a queue listing, and then greps the output to select messages
that match given criteria. The following selection options are available:
@@ -39503,7 +39524,22 @@ Display messages in reverse order.
Include delivered recipients in queue listing.
.endlist
+The following options give alternates for configuration:
+
+.vlist
+.vitem &*-C*&&~<&'config&~file'&>
+is used to specify an alternate &_exim.conf_& which might
+contain alternate exim configuration the queue management might be using.
+
+.vitem &*-E*&&~<&'path'&>
+can be used to specify a path for the exim binary,
+overriding the built-in one.
+.endlist
+
There is one more option, &%-h%&, which outputs a list of options.
+.new
+At least one selection option, or either the &*-c*& or &*-h*& option, must be given.
+.wen
@@ -41022,8 +41058,18 @@ was received, in the conventional Unix form &-- the number of seconds since the
start of the epoch. The second number is a count of the number of messages
warning of delayed delivery that have been sent to the sender.
-There follow a number of lines starting with a hyphen. These can appear in any
-order, and are omitted when not relevant:
+.new
+There follow a number of lines starting with a hyphen.
+These contain variables, can appear in any
+order, and are omitted when not relevant.
+
+If there is a second hyphen after the first,
+the corresponding data is tainted.
+If there is a value in parentheses, the data is quoted for a lookup.
+
+The following word specifies a variable,
+and the remainder of the item depends on the variable.
+.wen
.vlist
.vitem "&%-acl%&&~<&'number'&>&~<&'length'&>"
@@ -41179,9 +41225,6 @@ was received from the client, this records the Distinguished Name from that
certificate.
.endlist
-Any of the above may have an extra hyphen prepended, to indicate the the
-corresponding data is untrusted.
-
Following the options there is a list of those addresses to which the message
is not to be delivered. This set of addresses is initialized from the command
line when the &%-t%& option is used and &%extract_addresses_remove_arguments%&