X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/b98bae0c3627550c2ffa8fe6cad83a0ed7dc51d7..22452ad59f031b741bfcfe26519ba11a7508ac82:/doc/doc-docbook/spec.xfpt diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index dcda2ff79..36ed7ca09 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -1756,7 +1756,7 @@ headers are in an unusual location you will need to either set the PCRE2_LIBS and INCLUDE directives appropriately, or set PCRE2_CONFIG=yes to use the installed &(pcre-config)& command. If your operating system has no -PCRE2 support then you will need to obtain and build the current PCRE +PCRE2 support then you will need to obtain and build the current PCRE2 from &url(https://github.com/PhilipHazel/pcre2/releases). More information on PCRE2 is available at &url(https://www.pcre.org/). @@ -6755,6 +6755,9 @@ domains = ${lookup{$sender_host_address}lsearch{/some/file}} domains = lsearch;/some/file .endd The first uses a string expansion, the result of which must be a domain list. +.new +The key for an expansion-style lookup must be given explicitly. +.wen No strings have been specified for a successful or a failing lookup; the defaults in this case are the looked-up data and an empty string, respectively. The expansion takes place before the string is processed as a list, and the @@ -6779,6 +6782,12 @@ domain2: Any data that follows the keys is not relevant when checking that the domain matches the list item. +.new +The key for a list-style lookup is implicit, from the lookup context, if +the lookup is a single-key type (see below). +For query-style lookup types the key must be given explicitly. +.wen + It is possible, though no doubt confusing, to use both kinds of lookup at once. Consider a file containing lines like this: .code @@ -6813,7 +6822,7 @@ The &'single-key'& type requires the specification of a file in which to look, and a single key to search for. The key must be a non-empty string for the lookup to succeed. The lookup type determines how the file is searched. .cindex "tainted data" "single-key lookups" -The file string may not be tainted +The file string may not be tainted. .cindex "tainted data" "de-tainting" All single-key lookups support the option &"ret=key"&. @@ -10575,7 +10584,7 @@ sending the request. Values are &"yes"& (the default) or &"no"& &*tls*& Controls the use of TLS on the connection. Values are &"yes"& or &"no"& (the default). -If it is enabled, a shutdown as descripbed above is never done. +If it is enabled, a shutdown as described above is never done. .endlist @@ -12098,8 +12107,9 @@ matched using &%match_ip%&. .cindex "&%pam%& expansion condition" &'Pluggable Authentication Modules'& (&url(https://mirrors.edge.kernel.org/pub/linux/libs/pam/)) are a facility that is -available in the latest releases of Solaris and in some GNU/Linux -distributions. The Exim support, which is intended for use in conjunction with +available in Solaris +and in some GNU/Linux distributions. +The Exim support, which is intended for use in conjunction with the SMTP AUTH command, is available only if Exim is compiled with .code SUPPORT_PAM=yes @@ -15873,8 +15883,8 @@ described in section &<>&. .cindex "ESMTP extensions" DSN DSN extensions (RFC3461) will be advertised in the EHLO message to, and accepted from, these hosts. -Hosts may use the NOTIFY and ENVID options on RCPT TO commands, -and RET and ORCPT options on MAIL FROM commands. +Hosts may use the NOTIFY and ORCPT options on RCPT TO commands, +and RET and ENVID options on MAIL FROM commands. A NOTIFY=SUCCESS option requests success-DSN messages. A NOTIFY= option with no argument requests that no delay or failure DSNs are sent. @@ -18429,12 +18439,7 @@ larger prime than requested. The value of this option is expanded and indicates the source of DH parameters to be used by Exim. -This option is ignored for GnuTLS version 3.6.0 and later. -The library manages parameter negotiation internally. - -&*Note: The Exim Maintainers strongly recommend, -for other TLS library versions, -using a filename with site-generated +&*Note: The Exim Maintainers strongly recommend using a filename with site-generated local DH parameters*&, which has been supported across all versions of Exim. The other specific constants available are a fallback so that even when "unconfigured", Exim can offer Perfect Forward Secrecy in older ciphersuites in TLS. @@ -18485,8 +18490,17 @@ of the later IKE values, which led into RFC7919 providing new fixed constants (the "ffdhe" identifiers). At this point, all of the "ike" values should be considered obsolete; -they're still in Exim to avoid breaking unusual configurations, but are +they are still in Exim to avoid breaking unusual configurations, but are candidates for removal the next time we have backwards-incompatible changes. +.new +Two of them in particular (&`ike1`& and &`ike22`&) are called out by RFC 8247 +as MUST NOT use for IPSEC, and two more (&`ike23`& and &`ike24`&) as +SHOULD NOT. +Because of this, Exim regards them as deprecated; if either of the first pair +are used, warnings will be logged in the paniclog, and if any are used then +warnings will be logged in the mainlog. +All four will be removed in a future Exim release. +.wen The TLS protocol does not negotiate an acceptable size for this; clients tend to hard-drop connections if what is offered by the server is unacceptable, @@ -30464,6 +30478,11 @@ accepted by an &%accept%& verb that has a &%message%& modifier, the contents of the message override the banner message that is otherwise specified by the &%smtp_banner%& option. +.new +For tls-on-connect connections, the ACL is run after the TLS connection +is accepted (however, &%host_reject_connection%& is tested before). +.wen + .section "The EHLO/HELO ACL" "SECID192" .cindex "EHLO" "ACL for" @@ -39832,7 +39851,8 @@ For example, to dump the retry database: .code exim_dumpdb /var/spool/exim retry .endd -Two lines of output are produced for each entry: +For the retry database +two lines of output are produced for each entry: .code T:mail.ref.example:192.168.242.242 146 77 Connection refused 31-Oct-1995 12:00:12 02-Nov-1995 12:21:39 02-Nov-1995 20:21:39 * @@ -42598,6 +42618,7 @@ Events have names which correspond to the point in process at which they fire. The name is placed in the variable &$event_name$& and the event action expansion must check this, as it will be called for every possible event type. +.new The current list of events is: .display &`dane:fail after transport `& per connection @@ -42612,9 +42633,11 @@ The current list of events is: &`tcp:connect before transport `& per connection &`tcp:close after transport `& per connection &`tls:cert before both `& per certificate in verification chain +&`tls:fail:connect after main `& per connection &`smtp:connect after transport `& per connection &`smtp:ehlo after transport `& per connection .endd +.wen New event types may be added in future. The event name is a colon-separated list, defining the type of @@ -42640,6 +42663,7 @@ with the event type: &`msg:rcpt:host:defer `& error string &`msg:rcpt:defer `& error string &`tls:cert `& verification chain depth +&`tls:fail:connect `& error string &`smtp:connect `& smtp banner &`smtp:ehlo `& smtp ehlo response .endd