X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/774ef2d7d0f7fffbfd114271b8567e36485898dc..4fe0372a9546b7865b5508dee78166aedb07203c:/doc/doc-txt/experimental-spec.txt diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt index 2d34de0f7..aae8338f1 100644 --- a/doc/doc-txt/experimental-spec.txt +++ b/doc/doc-txt/experimental-spec.txt @@ -791,7 +791,7 @@ expansion is done. The current list of events is: msg:fail:internal after main per recipient tcp:connect before transport per connection tcp:close after transport per connection - tls:cert before transport per certificate in verification chain + tls:cert before both per certificate in verification chain smtp:connect after transport per connection The expansion is called for all event types, and should use the $event_name @@ -816,7 +816,7 @@ The following variables are likely to be useful depending on the event type: tls_out_peercert lookup_dnssec_authenticated, tls_out_dane sending_ip_address, sending_port - message_exim_id + message_exim_id, verify_mode An example might look like: @@ -852,6 +852,10 @@ following will be forced: No other use is made of the result string. +Known issues: +- the tls:cert event is only called for the cert chain elements + received over the wire, with GnuTLS. OpenSSL gives the entire + chain including thse loaded locally. Redis Lookup @@ -1080,82 +1084,6 @@ QUIT 221 mail.example.net closing connection -DSN Support --------------------------------------------------------------- - -DSN Support tries to add RFC 3461 support to Exim. It adds support for -*) the additional parameters for MAIL FROM and RCPT TO -*) RFC complient MIME DSN messages for all of - success, failure and delay notifications -*) dsn_advertise_hosts main option to select which hosts are able - to use the extension -*) dsn_lasthop router switch to end DSN processing - -In case of failure reports this means that the last three parts, the message body -intro, size info and final text, of the defined template are ignored since there is no -logical place to put them in the MIME message. - -All the other changes are made without changing any defaults - -Building exim: --------------- - -Define -EXPERIMENTAL_DSN=YES -in your Local/Makefile. - -Configuration: --------------- -All DSNs are sent in MIME format if you built exim with EXPERIMENTAL_DSN=YES -No option needed to activate it, and no way to turn it off. - -Failure and delay DSNs are triggered as usual except a sender used NOTIFY=... -to prevent them. - -Support for Success DSNs is added and activated by NOTIFY=SUCCESS by clients. - -Add -dsn_advertise_hosts = * -or a more restrictive host_list to announce DSN in EHLO answers - -Those hosts can then use NOTIFY,ENVID,RET,ORCPT options. - -If a message is relayed to a DSN aware host without changing the envelope -recipient the options are passed along and no success DSN is generated. - -A redirect router will always trigger a success DSN if requested and the DSN -options are not passed any further. - -A success DSN always contains the recipient address as submitted by the -client as required by RFC. Rewritten addresses are never exposed. - -If you used DSN patch up to 1.3 before remove all "dsn_process" switches from -your routers since you don't need them anymore. There is no way to "gag" -success DSNs anymore. Announcing DSN means answering as requested. - -You can prevent Exim from passing DSN options along to other DSN aware hosts by defining -dsn_lasthop -in a router. Exim will then send the success DSN himself if requested as if -the next hop does not support DSN. -Adding it to a redirect router makes no difference. - - -Certificate name checking --------------------------------------------------------------- -The X509 certificates used for TLS are supposed be verified -that they are owned by the expected host. The coding of TLS -support to date has not made these checks. - -If built with EXPERIMENTAL_CERTNAMES defined, code is -included to do so, and a new smtp transport option -"tls_verify_cert_hostname" supported which takes a list of -names for which the checks must be made. The host must -also be in "tls_verify_hosts". - -Both Subject and Subject-Alternate-Name certificate fields -are supported, as are wildcard certificates (limited to -a single wildcard being the initial component of a 3-or-more -component FQDN). DANE @@ -1300,7 +1228,7 @@ in the delivery log line will show as "CV=dane". There is a new variable $tls_out_dane which will have "yes" if verification succeeded using DANE and "no" otherwise (only useful -in combination with EXPERIMENTAL_TPDA), and a new variable +in combination with EXPERIMENTAL_EVENT), and a new variable $tls_out_tlsa_usage (detailed above).