X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/b98bae0c3627550c2ffa8fe6cad83a0ed7dc51d7..99f40596ce0881af49cc8bf61e588cdb55a2af30:/doc/doc-docbook/spec.xfpt diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index dcda2ff79..0ac98d668 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -239,14 +239,6 @@ failure report bounce message - - de-tainting - tainting, de-tainting - - - detainting - tainting, de-tainting - dialup intermittently connected hosts @@ -1756,7 +1748,7 @@ headers are in an unusual location you will need to either set the PCRE2_LIBS and INCLUDE directives appropriately, or set PCRE2_CONFIG=yes to use the installed &(pcre-config)& command. If your operating system has no -PCRE2 support then you will need to obtain and build the current PCRE +PCRE2 support then you will need to obtain and build the current PCRE2 from &url(https://github.com/PhilipHazel/pcre2/releases). More information on PCRE2 is available at &url(https://www.pcre.org/). @@ -1811,9 +1803,13 @@ the traditional &'ndbm'& interface. .next To complicate things further, there are several very different versions of the Berkeley DB package. Version 1.85 was stable for a very long time, releases -2.&'x'& and 3.&'x'& were current for a while, but the latest versions when Exim last revamped support were numbered 4.&'x'&. -Maintenance of some of the earlier releases has ceased. All versions of -Berkeley DB could be obtained from +2.&'x'& and 3.&'x'& were current for a while, +.new +but the latest versions when Exim last revamped support were numbered 5.&'x'&. +Maintenance of some of the earlier releases has ceased, +and Exim no longer supports versions before 3.&'x'&. +.wen +All versions of Berkeley DB could be obtained from &url(http://www.sleepycat.com/), which is now a redirect to their new owner's page with far newer versions listed. It is probably wise to plan to move your storage configurations away from @@ -1837,6 +1833,9 @@ USE_DB=yes .endd Similarly, for gdbm you set USE_GDBM, and for tdb you set USE_TDB. An error is diagnosed if you set more than one of these. +.new +You can set USE_NDBM if needed to override an operating system default. +.wen At the lowest level, the build-time configuration sets none of these options, thereby assuming an interface of type (1). However, some operating system @@ -1851,7 +1850,11 @@ in one of these lines: .code DBMLIB = -ldb DBMLIB = -ltdb +DBMLIB = -lgdbm -lgdbm_compat .endd +.new +The last of those was for a Linux having GDBM provide emulated NDBM facilities. +.wen Settings like that will work if the DBM library is installed in the standard place. Sometimes it is not, and the library's header file may also not be in the default path. You may need to set INCLUDE to specify where the header @@ -6755,6 +6758,9 @@ domains = ${lookup{$sender_host_address}lsearch{/some/file}} domains = lsearch;/some/file .endd The first uses a string expansion, the result of which must be a domain list. +.new +The key for an expansion-style lookup must be given explicitly. +.wen No strings have been specified for a successful or a failing lookup; the defaults in this case are the looked-up data and an empty string, respectively. The expansion takes place before the string is processed as a list, and the @@ -6779,6 +6785,12 @@ domain2: Any data that follows the keys is not relevant when checking that the domain matches the list item. +.new +The key for a list-style lookup is implicit, from the lookup context, if +the lookup is a single-key type (see below). +For query-style lookup types the key must be given explicitly. +.wen + It is possible, though no doubt confusing, to use both kinds of lookup at once. Consider a file containing lines like this: .code @@ -6813,7 +6825,7 @@ The &'single-key'& type requires the specification of a file in which to look, and a single key to search for. The key must be a non-empty string for the lookup to succeed. The lookup type determines how the file is searched. .cindex "tainted data" "single-key lookups" -The file string may not be tainted +The file string may not be tainted. .cindex "tainted data" "de-tainting" All single-key lookups support the option &"ret=key"&. @@ -6827,6 +6839,12 @@ version of the lookup key. The &'query-style'& type accepts a generalized database query. No particular key value is assumed by Exim for query-style lookups. You can use whichever Exim variables you need to construct the database query. +.cindex "tainted data" "quoting for lookups" +.new +If tainted data is used in the query then it should be quuted by +using the &*${quote_*&<&'lookup-type'&>&*:*&<&'string'&>&*}*& expansion operator +appropriate for the lookup. +.wen .endlist The code for each lookup type is in a separate source file that is included in @@ -6980,7 +6998,7 @@ IPv4, in dotted-quad form. (Exim converts IPv4-mapped IPv6 addresses to this notation before executing the lookup.) One option is supported, "ret=full", to request the return of the entire line -rather than omitting the key porttion. +rather than omitting the key portion. Note however that the key portion will have been de-quoted. .next @@ -9608,8 +9626,6 @@ reasons, .cindex expansion "tainted data" and expansion of data deriving from the sender (&"tainted data"&) is not permitted (including acessing a file using a tainted name). -The main config option &%allow_insecure_tainted_data%& can be used as -mitigation during uprades to more secure configurations. Common ways of obtaining untainted equivalents of variables with tainted values @@ -10575,7 +10591,7 @@ sending the request. Values are &"yes"& (the default) or &"no"& &*tls*& Controls the use of TLS on the connection. Values are &"yes"& or &"no"& (the default). -If it is enabled, a shutdown as descripbed above is never done. +If it is enabled, a shutdown as described above is never done. .endlist @@ -10647,16 +10663,28 @@ expansion items. This item inserts &"raw"& header lines. It is described with the &%header%& expansion item in section &<>& above. -.vitem "&*${run{*&<&'command'&>&*&~*&<&'args'&>&*}{*&<&'string1'&>&*}&&& +.vitem "&*${run <&'options'&> {*&<&'command&~arg&~list'&>&*}{*&<&'string1'&>&*}&&& {*&<&'string2'&>&*}}*&" .cindex "expansion" "running a command" .cindex "&%run%& expansion item" -The command and its arguments are first expanded as one string. The string is -split apart into individual arguments by spaces, and then the command is run +This item runs an external command, as a subprocess. +.new +One option is supported after the word &'run'&, comma-separated. + +If the option &'preexpand'& is not used, +the command string is split into individual arguments by spaces +and then each argument is expanded. +Then the command is run in a separate process, but under the same uid and gid. As in other command executions from Exim, a shell is not used by default. If the command requires a shell, you must explicitly code it. +The command name may not be tainted, but the remaining arguments can be. +If the option &'preexpand'& is used, +.wen +the command and its arguments are first expanded as one string. The result is +split apart into individual arguments by spaces, and then the command is run +as above. Since the arguments are split by spaces, when there is a variable expansion which has an empty result, it will cause the situation that the argument will simply be omitted when the program is actually executed by Exim. If the @@ -10667,6 +10695,9 @@ in a string containing quotes, because it would interfere with the quotes around the command arguments. A possible guard against this is to wrap the variable in the &%sg%& operator to change any quote marks to some other character. +.new +Neither the command nor any argument may be tainted. +.wen The standard input for the command exists, but is empty. The standard output and standard error are set to the same file descriptor. @@ -11886,6 +11917,19 @@ ${if inlisti{Needle}{fOo:NeeDLE:bAr}} ${if forany{fOo:NeeDLE:bAr}{eqi{$item}{Needle}}} .endd +.new +The variable &$value$& will be set for a successful match and can be +used in the success clause of an &%if%& expansion item using the condition. +.cindex "tainted data" "de-tainting" +It will have the same taint status as the list; expansions such as +.code +${if inlist {$h_mycode:} {0 : 1 : 42} {$value}} +.endd +can be used for de-tainting. +Any previous &$value$& is restored after the if. +.wen + + .vitem &*isip&~{*&<&'string'&>&*}*& &&& &*isip4&~{*&<&'string'&>&*}*& &&& &*isip6&~{*&<&'string'&>&*}*& @@ -12082,6 +12126,18 @@ item can be used, as in all address lists, to cause subsequent items to have their local parts matched casefully. Domains are always matched caselessly. +.new +The variable &$value$& will be set for a successful match and can be +used in the success clause of an &%if%& expansion item using the condition. +.cindex "tainted data" "de-tainting" +It will have the same taint status as the list; expansions such as +.code +${if match_local_part {$local_part} {alice : bill : charlotte : dave} {$value}} +.endd +can be used for de-tainting. +Any previous &$value$& is restored after the if. +.wen + Note that <&'string2'&> is not itself subject to string expansion, unless Exim was built with the EXPAND_LISTMATCH_RHS option. @@ -12098,8 +12154,9 @@ matched using &%match_ip%&. .cindex "&%pam%& expansion condition" &'Pluggable Authentication Modules'& (&url(https://mirrors.edge.kernel.org/pub/linux/libs/pam/)) are a facility that is -available in the latest releases of Solaris and in some GNU/Linux -distributions. The Exim support, which is intended for use in conjunction with +available in Solaris +and in some GNU/Linux distributions. +The Exim support, which is intended for use in conjunction with the SMTP AUTH command, is available only if Exim is compiled with .code SUPPORT_PAM=yes @@ -14588,7 +14645,6 @@ listed in more than one group. .section "Miscellaneous" "SECID96" .table2 .row &%add_environment%& "environment variables" -.row &%allow_insecure_tainted_data%& "turn taint errors into warnings" .row &%bi_command%& "to run for &%-bi%& command line option" .row &%debug_store%& "do extra internal checks" .row &%disable_ipv6%& "do no IPv6 processing" @@ -15202,17 +15258,6 @@ domains (defined in the named domain list &%local_domains%& in the default configuration). This &"magic string"& matches the domain literal form of all the local host's IP addresses. -.option allow_insecure_tainted_data main boolean false -.cindex "de-tainting" -.oindex "allow_insecure_tainted_data" -The handling of tainted data may break older (pre 4.94) configurations. -Setting this option to "true" turns taint errors (which result in a temporary -message rejection) into warnings. This option is meant as mitigation only -and deprecated already today. Future releases of Exim may ignore it. -The &%taint%& log selector can be used to suppress even the warnings. - - - .option allow_mx_to_ip main boolean false .cindex "MX record" "pointing to IP address" It appears that more and more DNS zone administrators are breaking the rules @@ -15873,8 +15918,8 @@ described in section &<>&. .cindex "ESMTP extensions" DSN DSN extensions (RFC3461) will be advertised in the EHLO message to, and accepted from, these hosts. -Hosts may use the NOTIFY and ENVID options on RCPT TO commands, -and RET and ORCPT options on MAIL FROM commands. +Hosts may use the NOTIFY and ORCPT options on RCPT TO commands, +and RET and ENVID options on MAIL FROM commands. A NOTIFY=SUCCESS option requests success-DSN messages. A NOTIFY= option with no argument requests that no delay or failure DSNs are sent. @@ -18429,12 +18474,7 @@ larger prime than requested. The value of this option is expanded and indicates the source of DH parameters to be used by Exim. -This option is ignored for GnuTLS version 3.6.0 and later. -The library manages parameter negotiation internally. - -&*Note: The Exim Maintainers strongly recommend, -for other TLS library versions, -using a filename with site-generated +&*Note: The Exim Maintainers strongly recommend using a filename with site-generated local DH parameters*&, which has been supported across all versions of Exim. The other specific constants available are a fallback so that even when "unconfigured", Exim can offer Perfect Forward Secrecy in older ciphersuites in TLS. @@ -18485,8 +18525,17 @@ of the later IKE values, which led into RFC7919 providing new fixed constants (the "ffdhe" identifiers). At this point, all of the "ike" values should be considered obsolete; -they're still in Exim to avoid breaking unusual configurations, but are +they are still in Exim to avoid breaking unusual configurations, but are candidates for removal the next time we have backwards-incompatible changes. +.new +Two of them in particular (&`ike1`& and &`ike22`&) are called out by RFC 8247 +as MUST NOT use for IPSEC, and two more (&`ike23`& and &`ike24`&) as +SHOULD NOT. +Because of this, Exim regards them as deprecated; if either of the first pair +are used, warnings will be logged in the paniclog, and if any are used then +warnings will be logged in the mainlog. +All four will be removed in a future Exim release. +.wen The TLS protocol does not negotiate an acceptable size for this; clients tend to hard-drop connections if what is offered by the server is unacceptable, @@ -25459,7 +25508,8 @@ servers or different local IP addresses. For example, if you want the string that is used for &%helo_data%& to be obtained by a DNS lookup of the outgoing interface address, you could use this: .code -helo_data = ${lookup dnsdb{ptr=$sending_ip_address}{$value}\ +helo_data = ${lookup dnsdb{ptr=$sending_ip_address} \ + {${listextract{1}{<\n $value}}} \ {$primary_hostname}} .endd The use of &%helo_data%& applies both to sending messages and when doing @@ -30464,6 +30514,11 @@ accepted by an &%accept%& verb that has a &%message%& modifier, the contents of the message override the banner message that is otherwise specified by the &%smtp_banner%& option. +.new +For tls-on-connect connections, the ACL is run after the TLS connection +is accepted (however, &%host_reject_connection%& is tested before). +.wen + .section "The EHLO/HELO ACL" "SECID192" .cindex "EHLO" "ACL for" @@ -31581,12 +31636,43 @@ sender when the destination system is doing content-scan based rejection. This control turns on debug logging, almost as though Exim had been invoked with &`-d`&, with the output going to a new logfile in the usual logs directory, by default called &'debuglog'&. -The filename can be adjusted with the &'tag'& option, which -may access any variables already defined. The logging may be adjusted with -the &'opts'& option, which takes the same values as the &`-d`& command-line -option. -Logging started this way may be stopped, and the file removed, -with the &'kill'& option. + +.new +Options are a slash-separated list. +If an option takes an argument, the option name and argument are separated by +an equals character. +Several options are supported: +.wen +.display +tag=<&'suffix'&> The filename can be adjusted with thise option. + The argument, which may access any variables already defined, + is appended to the default name. + +opts=<&'debug&~options'&> The argument specififes what is to be logged, + using the same values as the &`-d`& command-line option. + +stop Logging started with this control may be + stopped by using this option. + +kill Logging started with this control may be + stopped by using this option. + Additionally the debug file will be removed, + providing one means for speculative debug tracing. + +pretrigger=<&'size'&> This option specifies a memory buffuer to be used + for pre-trigger debug capture. + Debug lines are recorded in the buffer until + and if) a trigger occurs; at which time they are + dumped to the debug file. Newer lines displace the + oldest if the buffer is full. After a trigger, + immediate writes to file are done as normal. + +trigger=<&'reason'&> This option selects cause for the pretrigger buffer + see above) to be copied to file. A reason of $*now* + take effect immediately; one of &*paniclog*& triggers + on a write to the panic log. +.endd + Some examples (which depend on variables that don't exist in all contexts): .code @@ -31595,6 +31681,8 @@ contexts): control = debug/opts=+expand+acl control = debug/tag=.$message_exim_id/opts=+expand control = debug/kill + control = debug/opts=+all/pretrigger=1024/trigger=paniclog + control = debug/trigger=now .endd @@ -38838,7 +38926,6 @@ selection marked by asterisks: &` smtp_protocol_error `& SMTP protocol errors &` smtp_syntax_error `& SMTP syntax errors &` subject `& contents of &'Subject:'& on <= lines -&`*taint `& taint errors or warnings &`*tls_certificate_verified `& certificate verification status &`*tls_cipher `& TLS cipher suite on <= and => lines &` tls_peerdn `& TLS peer DN on <= and => lines @@ -39232,11 +39319,6 @@ using a CA trust anchor, &`CV=dane`& if using a DNS trust anchor, and &`CV=no`& if not. .next -.cindex "log" "Taint warnings" -&%taint%&: Log warnings about tainted data. This selector can't be -turned of if &%allow_insecure_tainted_data%& is false (which is the -default). -.next .cindex "log" "TLS cipher" .cindex "TLS" "logging cipher" &%tls_cipher%&: When a message is sent or received over an encrypted @@ -39381,9 +39463,6 @@ or (in case &*-a*& switch is specified) .code exim -bp .endd -The &*-C*& option is used to specify an alternate &_exim.conf_& which might -contain alternate exim configuration the queue management might be using. - to obtain a queue listing, and then greps the output to select messages that match given criteria. The following selection options are available: @@ -39440,7 +39519,22 @@ Display messages in reverse order. Include delivered recipients in queue listing. .endlist +The following options give alternates for configuration: + +.vlist +.vitem &*-C*&&~<&'config&~file'&> +is used to specify an alternate &_exim.conf_& which might +contain alternate exim configuration the queue management might be using. + +.vitem &*-E*&&~<&'path'&> +can be used to specify a path for the exim binary, +overriding the built-in one. +.endlist + There is one more option, &%-h%&, which outputs a list of options. +.new +At least one selection option, or either the &*-c*& or &*-h*& option, must be given. +.wen @@ -39832,7 +39926,8 @@ For example, to dump the retry database: .code exim_dumpdb /var/spool/exim retry .endd -Two lines of output are produced for each entry: +For the retry database +two lines of output are produced for each entry: .code T:mail.ref.example:192.168.242.242 146 77 Connection refused 31-Oct-1995 12:00:12 02-Nov-1995 12:21:39 02-Nov-1995 20:21:39 * @@ -40958,8 +41053,18 @@ was received, in the conventional Unix form &-- the number of seconds since the start of the epoch. The second number is a count of the number of messages warning of delayed delivery that have been sent to the sender. -There follow a number of lines starting with a hyphen. These can appear in any -order, and are omitted when not relevant: +.new +There follow a number of lines starting with a hyphen. +These contain variables, can appear in any +order, and are omitted when not relevant. + +If there is a second hyphen after the first, +the corresponding data is tainted. +If there is a value in parentheses, the data is quoted for a lookup. + +The following word specifies a variable, +and the remainder of the item depends on the variable. +.wen .vlist .vitem "&%-acl%&&~<&'number'&>&~<&'length'&>" @@ -41115,9 +41220,6 @@ was received from the client, this records the Distinguished Name from that certificate. .endlist -Any of the above may have an extra hyphen prepended, to indicate the the -corresponding data is untrusted. - Following the options there is a list of those addresses to which the message is not to be delivered. This set of addresses is initialized from the command line when the &%-t%& option is used and &%extract_addresses_remove_arguments%& @@ -42598,6 +42700,7 @@ Events have names which correspond to the point in process at which they fire. The name is placed in the variable &$event_name$& and the event action expansion must check this, as it will be called for every possible event type. +.new The current list of events is: .display &`dane:fail after transport `& per connection @@ -42612,9 +42715,11 @@ The current list of events is: &`tcp:connect before transport `& per connection &`tcp:close after transport `& per connection &`tls:cert before both `& per certificate in verification chain +&`tls:fail:connect after main `& per connection &`smtp:connect after transport `& per connection &`smtp:ehlo after transport `& per connection .endd +.wen New event types may be added in future. The event name is a colon-separated list, defining the type of @@ -42640,6 +42745,7 @@ with the event type: &`msg:rcpt:host:defer `& error string &`msg:rcpt:defer `& error string &`tls:cert `& verification chain depth +&`tls:fail:connect `& error string &`smtp:connect `& smtp banner &`smtp:ehlo `& smtp ehlo response .endd