X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/c13d09b8d3277897243fd25df73718da35cd4e1c..93cad488cb2c9a31aea345c8910a9f9c5815071c:/doc/doc-docbook/spec.xfpt?ds=inline diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index 795d3a1c1..4d620a36f 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -45,7 +45,7 @@ . Update the Copyright year (only) when changing content. . ///////////////////////////////////////////////////////////////////////////// -.set previousversion "4.80" +.set previousversion "4.83" .include ./local_params .set ACL "access control lists (ACLs)" @@ -5557,7 +5557,7 @@ unreachable. The next two lines are concerned with &'ident'& callbacks, as defined by RFC 1413 (hence their names): .code -rfc1413_query_hosts = * +rfc1413_hosts = * rfc1413_query_timeout = 0s .endd These settings cause Exim to avoid ident callbacks for all incoming SMTP calls. @@ -7005,7 +7005,6 @@ ${lookup dnsdb{a=one.host.com:two.host.com}} Thus, in the default case, as long as at least one of the DNS lookups yields some data, the lookup succeeds. -.new .cindex "DNSSEC" "dns lookup" Use of &(DNSSEC)& is controlled by a dnssec modifier. The possible keywords are @@ -7018,7 +7017,6 @@ is treated as equivalent to a temporary DNS error. The default is &"never"&. See also the &$lookup_dnssec_authenticated$& variable. -.wen @@ -7084,7 +7082,6 @@ With sufficiently modern LDAP libraries, Exim supports forcing TLS over regular LDAP connections, rather than the SSL-on-connect &`ldaps`&. See the &%ldap_start_tls%& option. -.new Starting with Exim 4.83, the initialization of LDAP with TLS is more tightly controlled. Every part of the TLS configuration can be configured by settings in &_exim.conf_&. Depending on the version of the client libraries installed on @@ -7094,7 +7091,6 @@ certificates. This revealed a nuance where the current UID that exim was running as could affect which config files it read. With Exim 4.83, these methods become optional, only taking effect if not specifically set in &_exim.conf_&. -.wen .section "LDAP quoting" "SECID68" @@ -7242,9 +7238,7 @@ them. The following names are recognized: &`USER `& set the DN, for authenticating the LDAP bind &`PASS `& set the password, likewise &`REFERRALS `& set the referrals parameter -.new &`SERVERS `& set alternate server list for this query only -.wen &`SIZE `& set the limit for the number of entries returned &`TIME `& set the maximum waiting time for a query .endd @@ -7266,15 +7260,13 @@ Netscape SDK; for OpenLDAP no action is taken. The TIME parameter (also a number of seconds) is passed to the server to set a server-side limit on the time taken to complete a search. -.new The SERVERS parameter allows you to specify an alternate list of ldap servers to use for an individual lookup. The global ldap_servers option provides a default list of ldap servers, and a single lookup can specify a single ldap server to use. But when you need to do a lookup with a list of servers that is different than the default list (maybe different order, maybe a completely different set of servers), the SERVERS parameter allows you to specify this -alternate list. -.wen +alternate list (colon-separated). Here is an example of an LDAP query in an Exim lookup that uses some of these values. This is a single line, folded to fit on the page: @@ -7346,6 +7338,10 @@ If you specify multiple attributes, the result contains space-separated, quoted strings, each preceded by the attribute name and an equals sign. Within the quotes, the quote character, backslash, and newline are escaped with backslashes, and commas are used to separate multiple values for the attribute. +.new +Any commas in attribute values are doubled +(permitting treatment of the values as a comma-separated list). +.wen Apart from the escaping, the string within quotes takes the same form as the output when a single attribute is requested. Specifying no attributes is the same as specifying all of an entry's attributes. @@ -7355,21 +7351,26 @@ LDAP query, and the second is the data that is returned. The attribute called &%attr1%& has two values, whereas &%attr2%& has only one value: .code ldap:///o=base?attr1?sub?(uid=fred) -value1.1, value1.2 +value1.1,value1.2 ldap:///o=base?attr2?sub?(uid=fred) value two ldap:///o=base?attr1,attr2?sub?(uid=fred) -attr1="value1.1, value1.2" attr2="value two" +attr1="value1.1,value1.2" attr2="value two" ldap:///o=base??sub?(uid=fred) -objectClass="top" attr1="value1.1, value1.2" attr2="value two" +objectClass="top" attr1="value1.1,value1.2" attr2="value two" .endd -The &%extract%& operator in string expansions can be used to pick out -individual fields from data that consists of &'key'&=&'value'& pairs. You can +You can make use of Exim's &%-be%& option to run expansion tests and thereby check the results of LDAP lookups. +The &%extract%& operator in string expansions can be used to pick out +individual fields from data that consists of &'key'&=&'value'& pairs. +.new +The &%listextract%& operator should be used to pick out individual values +of attributes, even when only a single value is expected. +.wen @@ -8354,7 +8355,6 @@ Both &`+include_unknown`& and &`+ignore_unknown`& may appear in the same list. The effect of each one lasts until the next, or until the end of the list. -.new .section "Mixing wildcarded host names and addresses in host lists" &&& "SECTmixwilhos" .cindex "host list" "mixing names and addresses in" @@ -8390,7 +8390,6 @@ If the first &%accept%& fails, Exim goes on to try the second one. See chapter &`+ignore_unknown`&, which was discussed in depth in the first example in this section. .endlist -.wen .section "Temporary DNS errors when looking up host information" &&& @@ -8885,7 +8884,6 @@ the expansion result is an empty string. If the ACL returns defer the result is a forced-fail. Otherwise the expansion fails. -.new .vitem "&*${certextract{*&<&'field'&>&*}{*&<&'certificate'&>&*}&&& {*&<&'string2'&>&*}{*&<&'string3'&>&*}}*&" .cindex "expansion" "extracting cerificate fields" @@ -8948,7 +8946,6 @@ which is one of "dns", "uri" or "mail"; if so the elenment tags are omitted. If not otherwise noted field values are presented in human-readable form. -.wen .vitem "&*${dlfunc{*&<&'file'&>&*}{*&<&'function'&>&*}{*&<&'arg'&>&*}&&& {*&<&'arg'&>&*}...}*&" @@ -9597,7 +9594,6 @@ expansion item above. {*&<&'string2'&>&*}}*&" .cindex "expansion" "running a command" .cindex "&%run%& expansion item" -.new The command and its arguments are first expanded as one string. The string is split apart into individual arguments by spaces, and then the command is run in a separate process, but under the same uid and gid. As in other command @@ -9610,10 +9606,10 @@ simply be omitted when the program is actually executed by Exim. If the script/program requires a specific number of arguments and the expanded variable could possibly result in this empty expansion, the variable must be quoted. This is more difficult if the expanded variable itself could result -in a string containing quotes, because it would with the quotes around the -command arguments. A possible guard against this is to wrap the variable in -the &%sg%& operator to change any quote marks to some other character. -.wen +in a string containing quotes, because it would interfere with the quotes +around the command arguments. A possible guard against this is to wrap the +variable in the &%sg%& operator to change any quote marks to some other +character. The standard input for the command exists, but is empty. The standard output and standard error are set to the same file descriptor. @@ -11010,6 +11006,11 @@ precedes the expansion of the string. For example, the commands available in Exim filter files include an &%if%& command with its own regular expression matching condition. +.vitem "&$acl_arg1$&, &$acl_arg2$&, etc" +Within an acl condition, expansion condition or expansion item +any arguments are copied to these variables, +any unused variables being made empty. + .vitem "&$acl_c...$&" Values can be placed in these variables by the &%set%& modifier in an ACL. They can be given any name that starts with &$acl_c$& and is at least six characters @@ -11031,6 +11032,10 @@ message is received, the values of these variables are saved with the message, and can be accessed by filters, routers, and transports during subsequent delivery. +.vitem &$acl_narg$& +Within an acl condition, expansion condition or expansion item +this variable has the number of arguments. + .vitem &$acl_verify_message$& .vindex "&$acl_verify_message$&" After an address verification has failed, this variable contains the failure @@ -11417,6 +11422,11 @@ the result, the name is not accepted, and &$host_lookup_deferred$& is set to .vindex "&$host_lookup_failed$&" See &$host_lookup_deferred$&. +.vitem &$host_port$& +.vindex "&$host_port$&" +This variable is set to the remote host's TCP port whenever &$host$& is set +for an outbound connection. + .vitem &$inode$& .vindex "&$inode$&" @@ -11569,7 +11579,6 @@ ability to find the amount of free space (only true for experimental systems), the space value is -1. See also the &%check_log_space%& option. -.new .vitem &$lookup_dnssec_authenticated$& .vindex "&$lookup_dnssec_authenticated$&" This variable is set after a DNS lookup done by @@ -11577,7 +11586,6 @@ a dnsdb lookup expansion, dnslookup router or smtp transport. It will be empty if &(DNSSEC)& was not requested, &"no"& if the result was not labelled as authenticated data and &"yes"& if it was. -.wen .vitem &$mailstore_basename$& .vindex "&$mailstore_basename$&" @@ -11665,7 +11673,7 @@ This variable is like &$message_headers$& except that no processing of the contents of header lines is done. .vitem &$message_id$& -This is an old name for &$message_exim_id$&, which is now deprecated. +This is an old name for &$message_exim_id$&. It is now deprecated. .vitem &$message_linecount$& .vindex "&$message_linecount$&" @@ -12356,43 +12364,43 @@ on an outbound SMTP connection; the meaning of this depends upon the TLS implementation used. If TLS has not been negotiated, the value will be 0. -.new .vitem &$tls_in_ourcert$& .vindex "&$tls_in_ourcert$&" This variable refers to the certificate presented to the peer of an inbound connection when the message was received. It is only useful as the argument of a -&%certextract%& expansion item, &%md5%& or &%sha1%& operator, -or a &%def%& condition. +.new +&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator, .wen +or a &%def%& condition. -.new .vitem &$tls_in_peercert$& .vindex "&$tls_in_peercert$&" This variable refers to the certificate presented by the peer of an inbound connection when the message was received. It is only useful as the argument of a -&%certextract%& expansion item, &%md5%& or &%sha1%& operator, -or a &%def%& condition. +.new +&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator, .wen +or a &%def%& condition. -.new .vitem &$tls_out_ourcert$& .vindex "&$tls_out_ourcert$&" This variable refers to the certificate presented to the peer of an outbound connection. It is only useful as the argument of a -&%certextract%& expansion item, &%md5%& or &%sha1%& operator, -or a &%def%& condition. +.new +&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator, .wen +or a &%def%& condition. -.new .vitem &$tls_out_peercert$& .vindex "&$tls_out_peercert$&" This variable refers to the certificate presented by the peer of an outbound connection. It is only useful as the argument of a -&%certextract%& expansion item, &%md5%& or &%sha1%& operator, -or a &%def%& condition. +.new +&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator, .wen +or a &%def%& condition. .vitem &$tls_in_certificate_verified$& .vindex "&$tls_in_certificate_verified$&" @@ -12431,6 +12439,24 @@ and then set to the outgoing cipher suite if one is negotiated. See chapter &<>& for details of TLS support and chapter &<>& for details of the &(smtp)& transport. +.vitem &$tls_in_ocsp$& +.vindex "&$tls_in_ocsp$&" +When a message is received from a remote client connection +the result of any OCSP request from the client is encoded in this variable: +.code +0 OCSP proof was not requested (default value) +1 No response to request +2 Response not verified +3 Verification failed +4 Verification succeeded +.endd + +.vitem &$tls_out_ocsp$& +.vindex "&$tls_out_ocsp$&" +When a message is sent to a remote host connection +the result of any OCSP request made is encoded in this variable. +See &$tls_in_ocsp$& for values. + .vitem &$tls_in_peerdn$& .vindex "&$tls_in_peerdn$&" .vindex "&$tls_peerdn$&" @@ -16796,6 +16822,39 @@ If the expansion fails (other than forced failure) delivery is deferred. Some of the other precondition options are common special cases that could in fact be specified using &%condition%&. +.new +When originally designed, Exim's ACL system enforced very strict parsing +of the &%condition%& expansion everywhere it was being processed. +Through the 4.7x release cycle, the &%condition%& processing while in a +router became more loose, internally adopting the use of &%bool_lax%& +instead of the more rigid &%bool%&. This is best illustrated in an +example: +.code +# This used to fail with a syntax error, now it +# treats any extra characters as a string + +$ exim -be '${if eq {${lc:GOOGLE.com}} {google.com}} {yes} {no}}' +true {yes} {no}} + +$ exim -be '${if eq {${lc:WHOIS.com}} {google.com}} {yes} {no}}' + {yes} {no}} +.endd +In each example above, the &%if%& statement actually ends after +&"{google.com}}"&. Since no true or false braces were defined, the +default &%if%& behavior is to return a boolean true or a null answer +(which evaluates to false). The rest of the line is then treated as a +string. So the first example resulted in the boolean answer &"true"& +with the string &" {yes} {no}}"& appended to it. The second example +resulted in the null output (indicating false) with the string +&" {yes} {no}}"& appended to it. + +In fact you can put excess forward braces in too. In the router +&%condition%&, Exim's ACL parser only looks for &"{"& symbols when they +mean something, like after a &"$"& or when required as part of a +conditional. But otherwise &"{"& and &"}"& are treated as ordinary +string characters. +.wen + .option debug_print routers string&!! unset .cindex "testing" "variables in drivers" @@ -17850,7 +17909,6 @@ when there is a DNS lookup error. -.new .option dnssec_request_domains dnslookup "domain list&!!" unset .cindex "MX record" "security" .cindex "DNSSEC" "MX lookup" @@ -17859,11 +17917,9 @@ when there is a DNS lookup error. DNS lookups for domains matching &%dnssec_request_domains%& will be done with the dnssec request bit set. This applies to all of the SRV, MX A6, AAAA, A lookup sequence. -.wen -.new .option dnssec_require_domains dnslookup "domain list&!!" unset .cindex "MX record" "security" .cindex "DNSSEC" "MX lookup" @@ -17873,7 +17929,6 @@ DNS lookups for domains matching &%dnssec_request_domains%& will be done with the dnssec request bit set. Any returns not having the Authenticated Data bit (AD bit) set wil be ignored and logged as a host-lookup failure. This applies to all of the SRV, MX A6, AAAA, A lookup sequence. -.wen @@ -22780,7 +22835,6 @@ See the &%search_parents%& option in chapter &<>& for more details. -.new .option dnssec_request_domains smtp "domain list&!!" unset .cindex "MX record" "security" .cindex "DNSSEC" "MX lookup" @@ -22789,11 +22843,9 @@ details. DNS lookups for domains matching &%dnssec_request_domains%& will be done with the dnssec request bit set. This applies to all of the SRV, MX A6, AAAA, A lookup sequence. -.wen -.new .option dnssec_require_domains smtp "domain list&!!" unset .cindex "MX record" "security" .cindex "DNSSEC" "MX lookup" @@ -22803,7 +22855,6 @@ DNS lookups for domains matching &%dnssec_request_domains%& will be done with the dnssec request bit set. Any returns not having the Authenticated Data bit (AD bit) set wil be ignored and logged as a host-lookup failure. This applies to all of the SRV, MX A6, AAAA, A lookup sequence. -.wen @@ -25394,6 +25445,7 @@ but it is present in many binary distributions. .scindex IIDdcotauth2 "authenticators" "&(dovecot)&" This authenticator is an interface to the authentication facility of the Dovecot POP/IMAP server, which can support a number of authentication methods. +Note that Dovecot must be configured to use auth-client not auth-userdb. If you are using Dovecot to authenticate POP/IMAP clients, it might be helpful to use the same mechanisms for SMTP authentication. This is a server authenticator only. There is only one option: @@ -26262,6 +26314,8 @@ file named by &%tls_ocsp_file%&. Note that the proof only covers the terminal server certificate, not any of the chain from CA to it. +There is no current way to staple a proof for a client certificate. + .code A helper script "ocsp_fetch.pl" for fetching a proof from a CA OCSP server is supplied. The server URL may be included in the @@ -27625,6 +27679,11 @@ anyway. If the message contains newlines, this gives rise to a multi-line SMTP response. .vindex "&$acl_verify_message$&" +.new +For ACLs that are called by an &%acl =%& ACL condition, the message is +stored in &$acl_verify_message$&, from which the calling ACL may use it. +.wen + If &%message%& is used on a statement that verifies an address, the message specified overrides any message that is generated by the verification process. However, the original message is available in the variable @@ -28430,7 +28489,6 @@ This condition checks whether the sending host (the client) is authorized to send email. Details of how this works are given in section &<>&. -.new .vitem &*verify&~=&~header_names_ascii*& .cindex "&%verify%& ACL condition" .cindex "&ACL;" "verifying header names only ASCII" @@ -28445,7 +28503,6 @@ allowable characters are decimal ASCII values 33 through 126. Exim itself will handle headers with non-ASCII characters, but it can cause problems for downstream applications, so this option will allow their detection and rejection in the DATA ACL's. -.wen .vitem &*verify&~=&~header_sender/*&<&'options'&> .cindex "&%verify%& ACL condition" @@ -35059,10 +35116,8 @@ or (in case &*-a*& switch is specified) .code exim -bp .endd -.new The &*-C*& option is used to specify an alternate &_exim.conf_& which might contain alternate exim configuration the queue management might be using. -.wen to obtain a queue listing, and then greps the output to select messages that match given criteria. The following selection options are available: