Merge branch 'master' of ssh://git.exim.org/home/git/exim

[users/heiko/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 4a9b3b9550fc0d8dce1f6537140463996bb0ed0e..31767bf5552e1c36857d8fd39938f068b7f3672c 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -179,12 +179,7 @@
 <author><firstname>Exim</firstname><surname>Maintainers</surname></author>
 <authorinitials>EM</authorinitials>
 <revhistory><revision>
 <author><firstname>Exim</firstname><surname>Maintainers</surname></author>
 <authorinitials>EM</authorinitials>
 <revhistory><revision>

-  <revnumber>
-.version
-  </revnumber>
-  <date>
-.fulldate
-  </date>
+.versiondatexml

   <authorinitials>EM</authorinitials>
 </revision></revhistory>
 <copyright><year>
   <authorinitials>EM</authorinitials>
 </revision></revhistory>
 <copyright><year>


@@ -746,6 +741,7 @@ the Exim documentation, &"spool"& is always used in the first sense.
 .cindex "incorporated code"
 .cindex "regular expressions" "library"
 .cindex "PCRE"
 .cindex "incorporated code"
 .cindex "regular expressions" "library"
 .cindex "PCRE"

+.cindex "OpenDMARC"

 A number of pieces of external code are included in the Exim distribution.
 
 .ilist
 A number of pieces of external code are included in the Exim distribution.
 
 .ilist


@@ -870,6 +866,14 @@ ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
 SOFTWARE.
 .endblockquote
 
 SOFTWARE.
 .endblockquote
 

+.next
+.cindex "opendmarc" "acknowledgment"
+The DMARC implementation uses the OpenDMARC library which is Copyrighted by
+The Trusted Domain Project. Portions of Exim source which use OpenDMARC
+derived code are indicated in the respective source files. The full OpenDMARC
+license is provided in the LICENSE.opendmarc file contained in the distributed
+source code.
+

 .next
 Many people have contributed code fragments, some large, some small, that were
 not covered by any specific licence requirements. It is assumed that the
 .next
 Many people have contributed code fragments, some large, some small, that were
 not covered by any specific licence requirements. It is assumed that the


@@ -4335,7 +4339,7 @@ For compatibility with Sendmail, this option is equivalent to
 It sets the incoming protocol and host name (for trusted callers). The
 host name and its colon can be omitted when only the protocol is to be set.
 Note the Exim already has two private options, &%-pd%& and &%-ps%&, that refer
 It sets the incoming protocol and host name (for trusted callers). The
 host name and its colon can be omitted when only the protocol is to be set.
 Note the Exim already has two private options, &%-pd%& and &%-ps%&, that refer

-to embedded Perl. It is therefore impossible to set a protocol value of &`p`&
+to embedded Perl. It is therefore impossible to set a protocol value of &`d`&

 or &`s`& using this option (but that does not seem a real limitation).
 
 .vitem &%-q%&
 or &`s`& using this option (but that does not seem a real limitation).
 
 .vitem &%-q%&


@@ -8259,10 +8263,13 @@ apply to temporary DNS errors, whose handling is described in the next section.
 
 .cindex "&`+include_unknown`&"
 .cindex "&`+ignore_unknown`&"
 
 .cindex "&`+include_unknown`&"
 .cindex "&`+ignore_unknown`&"

-By default, Exim behaves as if the host does not match the list. This may not
-always be what you want to happen. To change Exim's behaviour, the special
-items &`+include_unknown`& or &`+ignore_unknown`& may appear in the list (at
-top level &-- they are not recognized in an indirected file).
+Exim parses a host list from left to right. If it encounters a permanent
+lookup failure in any item in the host list before it has found a match,
+Exim treats it as a failure and the default behavior is as if the host
+does not match the list. This may not always be what you want to happen.
+To change Exim's behaviour, the special items &`+include_unknown`& or
+&`+ignore_unknown`& may appear in the list (at top level &-- they are
+not recognized in an indirected file).

 
 .ilist
 If any item that follows &`+include_unknown`& requires information that
 
 .ilist
 If any item that follows &`+include_unknown`& requires information that


@@ -8290,6 +8297,37 @@ Both &`+include_unknown`& and &`+ignore_unknown`& may appear in the same
 list. The effect of each one lasts until the next, or until the end of the
 list.
 
 list. The effect of each one lasts until the next, or until the end of the
 list.
 

+To explain the host/ip processing logic a different way for the same ACL:
+
+.ilist
+If you have name lookups or wildcarded host names and
+IP addresses in the same host list, you should normally put the IP
+addresses first. For example, in an ACL you could have:
+.code
+accept hosts = 10.9.8.7 : *.friend.example
+.endd
+The reason you normally would order it this way lies in the
+left-to-right way that Exim processes lists.  It can test IP addresses
+without doing any DNS lookups, but when it reaches an item that requires
+a host name, it fails if it cannot find a host name to compare with the
+pattern. If the above list is given in the opposite order, the
+&%accept%& statement fails for a host whose name cannot be found, even
+if its IP address is 10.9.8.7.
+
+.next
+If you really do want to do the name check first, and still recognize the IP
+address, you can rewrite the ACL like this:
+.code
+accept hosts = *.friend.example
+accept hosts = 10.9.8.7
+.endd
+If the first &%accept%& fails, Exim goes on to try the second one. See chapter
+&<<CHAPACL>>& for details of ACLs. Alternatively, you can use
+&`+ignore_unknown`&, which was discussed in depth in the first example in
+this section.
+.endlist
+
+

 
 .section "Temporary DNS errors when looking up host information" &&&
          "SECTtemdnserr"
 
 .section "Temporary DNS errors when looking up host information" &&&
          "SECTtemdnserr"


@@ -9768,6 +9806,16 @@ This operator converts a hex string into one that is base64 encoded. This can
 be useful for processing the output of the MD5 and SHA-1 hashing functions.
 
 
 be useful for processing the output of the MD5 and SHA-1 hashing functions.
 
 

+
+.vitem &*${hexquote:*&<&'string'&>&*}*&
+.cindex "quoting" "hex-encoded unprintable characters"
+.cindex "&%hexquote%& expansion item"
+This operator converts non-printable characters in a string into a hex
+escape form. Byte values between 33 (!) and 126 (~) inclusive are left
+as is, and other byte values are converted to &`\xNN`&, for example a
+byt value 127 is converted to &`\x7f`&.
+
+

 .vitem &*${lc:*&<&'string'&>&*}*&
 .cindex "case forcing in strings"
 .cindex "string" "case forcing"
 .vitem &*${lc:*&<&'string'&>&*}*&
 .cindex "case forcing in strings"
 .cindex "string" "case forcing"


@@ -10318,6 +10366,8 @@ ${if forany{<, $recipients}{match{$item}{^user3@}}{yes}{no}}
 The value of &$item$& is saved and restored while &*forany*& or &*forall*& is
 being processed, to enable these expansion items to be nested.
 
 The value of &$item$& is saved and restored while &*forany*& or &*forall*& is
 being processed, to enable these expansion items to be nested.
 

+To scan a named list, expand it with the &*listnamed*& operator.
+

 
 .vitem &*ge&~{*&<&'string1'&>&*}{*&<&'string2'&>&*}*& &&&
        &*gei&~{*&<&'string1'&>&*}{*&<&'string2'&>&*}*&
 
 .vitem &*ge&~{*&<&'string1'&>&*}{*&<&'string2'&>&*}*& &&&
        &*gei&~{*&<&'string1'&>&*}{*&<&'string2'&>&*}*&


@@ -10861,6 +10911,16 @@ the value of &$authenticated_id$& is normally the login name of the calling
 process. However, a trusted user can override this by means of the &%-oMai%&
 command line option.
 
 process. However, a trusted user can override this by means of the &%-oMai%&
 command line option.
 

+.vitem &$authenticated_fail_id$&
+.cindex "authentication" "fail" "id"
+.vindex "&$authenticated_fail_id$&"
+When an authentication attempt fails, the variable &$authenticated_fail_id$&
+will contain the failed authentication id. If more than one authentication
+id is attempted, it will contain only the last one. The variable is
+available for processing in the ACL's, generally the quit or notquit ACL.
+A message to a local recipient could still be accepted without requiring
+authentication, which means this variable could also be visible in all of
+the ACL's as well.

 
 
 
 
 
 


@@ -13965,7 +14025,7 @@ This option will let GnuTLS (2.12.0 or later) autoload PKCS11 modules with
 the p11-kit configuration files in &_/etc/pkcs11/modules/_&.
 
 See
 the p11-kit configuration files in &_/etc/pkcs11/modules/_&.
 
 See

-&url(http://www.gnu.org/software/gnutls/manual/gnutls.html#Smart-cards-and-HSMs)
+&url(http://www.gnutls.org/manual/gnutls.html#Smart-cards-and-HSMs)

 for documentation.
 .wen
 
 for documentation.
 .wen
 


@@ -14721,6 +14781,8 @@ Possible options may include:
 .next
 &`no_tlsv1_2`&
 .next
 .next
 &`no_tlsv1_2`&
 .next

+&`safari_ecdhe_ecdsa_bug`&
+.next

 &`single_dh_use`&
 .next
 &`single_ecdh_use`&
 &`single_dh_use`&
 .next
 &`single_ecdh_use`&


@@ -14736,6 +14798,15 @@ Possible options may include:
 &`tls_rollback_bug`&
 .endlist
 
 &`tls_rollback_bug`&
 .endlist
 

+.new
+As an aside, the &`safari_ecdhe_ecdsa_bug`& item is a misnomer and affects
+all clients connecting using the MacOS SecureTransport TLS facility prior
+to MacOS 10.8.4, including email clients.  If you see old MacOS clients failing
+to negotiate TLS then this option value might help, provided that your OpenSSL
+release is new enough to contain this work-around.  This may be a situation
+where you have to upgrade OpenSSL to get buggy clients working.
+.wen
+

 
 .option oracle_servers main "string list" unset
 .cindex "Oracle" "server list"
 
 .option oracle_servers main "string list" unset
 .cindex "Oracle" "server list"


@@ -15305,6 +15376,13 @@ live with.
 
 . Allow this long option name to split; give it unsplit as a fifth argument
 . for the automatic .oindex that is generated by .option.
 
 . Allow this long option name to split; give it unsplit as a fifth argument
 . for the automatic .oindex that is generated by .option.

+. We insert " &~&~" which is both pretty nasty visually and results in
+. non-searchable text.  HowItWorks.txt mentions an option for inserting
+. zero-width-space, which would be nicer visually and results in (at least)
+. html that Firefox will split on when it's forced to reflow (rather than
+. inserting a horizontal scrollbar).  However, the text is still not
+. searchable.  NM changed this occurrence for bug 1197 to no longer allow
+. the option name to split.

 
 .option "smtp_accept_max_per_connection" main integer 1000 &&&
          smtp_accept_max_per_connection
 
 .option "smtp_accept_max_per_connection" main integer 1000 &&&
          smtp_accept_max_per_connection


@@ -15356,10 +15434,9 @@ also &%queue_only%&, &%queue_only_load%&, &%queue_smtp_domains%&, and the
 various &%-od%&&'x'& command line options.
 
 
 various &%-od%&&'x'& command line options.
 
 

-. Allow this long option name to split; give it unsplit as a fifth argument
-. for the automatic .oindex that is generated by .option.
+. See the comment on smtp_accept_max_per_connection

 
 

-.option "smtp_accept_queue_per_ &~&~connection" main integer 10 &&&
+.option "smtp_accept_queue_per_connection" main integer 10 &&&

          smtp_accept_queue_per_connection
 .cindex "queueing incoming messages"
 .cindex "message" "queueing by message count"
          smtp_accept_queue_per_connection
 .cindex "queueing incoming messages"
 .cindex "message" "queueing by message count"


@@ -15999,6 +16076,21 @@ The available primes are:
 Some of these will be too small to be accepted by clients.
 Some may be too large to be accepted by clients.
 
 Some of these will be too small to be accepted by clients.
 Some may be too large to be accepted by clients.
 

+The TLS protocol does not negotiate an acceptable size for this; clients tend
+to hard-drop connections if what is offered by the server is unacceptable,
+whether too large or too small, and there's no provision for the client to
+tell the server what these constraints are.  Thus, as a server operator, you
+need to make an educated guess as to what is most likely to work for your
+userbase.
+
+Some known size constraints suggest that a bit-size in the range 2048 to 2236
+is most likely to maximise interoperability.  The upper bound comes from
+applications using the Mozilla Network Security Services (NSS) library, which
+used to set its &`DH_MAX_P_BITS`& upper-bound to 2236.  This affects many
+mail user agents (MUAs). The lower bound comes from Debian installs of Exim4
+prior to the 4.80 release, as Debian used to patch Exim to raise the minimum
+acceptable bound from 1024 to 2048.
+

 
 .option tls_on_connect_ports main "string list" unset
 This option specifies a list of incoming SSMTP (aka SMTPS) ports that should
 
 .option tls_on_connect_ports main "string list" unset
 This option specifies a list of incoming SSMTP (aka SMTPS) ports that should


@@ -23518,7 +23610,7 @@ In practice, almost all rules start with a domain name pattern without a local
 part.
 
 .cindex "regular expressions" "in retry rules"
 part.
 
 .cindex "regular expressions" "in retry rules"

-&*Warning*&: If you use a regular expression in a routing rule pattern, it
+&*Warning*&: If you use a regular expression in a retry rule pattern, it

 must match a complete address, not just a domain, because that is how regular
 expressions work in address lists.
 .display
 must match a complete address, not just a domain, because that is how regular
 expressions work in address lists.
 .display


@@ -24501,7 +24593,8 @@ to be returned. If the result of a successful expansion is an empty string,
 expansion is &"1"&, &"yes"&, or &"true"&, authentication succeeds and the
 generic &%server_set_id%& option is expanded and saved in &$authenticated_id$&.
 For any other result, a temporary error code is returned, with the expanded
 expansion is &"1"&, &"yes"&, or &"true"&, authentication succeeds and the
 generic &%server_set_id%& option is expanded and saved in &$authenticated_id$&.
 For any other result, a temporary error code is returned, with the expanded

-string as the error text.
+string as the error text, and the failed id saved in
+&$authenticated_fail_id$&.

 
 &*Warning*&: If you use a lookup in the expansion to find the user's
 password, be sure to make the authentication fail if the user is unknown.
 
 &*Warning*&: If you use a lookup in the expansion to find the user's
 password, be sure to make the authentication fail if the user is unknown.


@@ -25565,10 +25658,10 @@ aware of future feature enhancements of GnuTLS.
 
 Documentation of the strings accepted may be found in the GnuTLS manual, under
 "Priority strings".  This is online as
 
 Documentation of the strings accepted may be found in the GnuTLS manual, under
 "Priority strings".  This is online as

-&url(http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html),
+&url(http://www.gnutls.org/manual/html_node/Priority-Strings.html),

 but beware that this relates to GnuTLS 3, which may be newer than the version
 installed on your system.  If you are using GnuTLS 3,
 but beware that this relates to GnuTLS 3, which may be newer than the version
 installed on your system.  If you are using GnuTLS 3,

-&url(http://www.gnu.org/software/gnutls/manual/html_node/Listing-the-ciphersuites-in-a-priority-string.html, then the example code)
+&url(http://www.gnutls.org/manual/gnutls.html#Listing-the-ciphersuites-in-a-priority-string, then the example code)

 on that site can be used to test a given string.
 
 Prior to Exim 4.80, an older API of GnuTLS was used, and Exim supported three
 on that site can be used to test a given string.
 
 Prior to Exim 4.80, an older API of GnuTLS was used, and Exim supported three


@@ -25654,7 +25747,7 @@ tls_dhparam = none
 This may also be set to a string identifying a standard prime to be used for
 DH; if it is set to &`default`& or, for OpenSSL, is unset, then the prime
 used is &`ike23`&.  There are a few standard primes available, see the
 This may also be set to a string identifying a standard prime to be used for
 DH; if it is set to &`default`& or, for OpenSSL, is unset, then the prime
 used is &`ike23`&.  There are a few standard primes available, see the

-documetnation for &%tls_dhparam%& for the complete list.
+documentation for &%tls_dhparam%& for the complete list.

 
 See the command
 .code
 
 See the command
 .code


@@ -27065,6 +27158,21 @@ the message is ultimately accepted. For details, see section &<<SECTremoveheadac
 .cindex "&%set%& ACL modifier"
 This modifier puts a value into one of the ACL variables (see section
 &<<SECTaclvariables>>&).
 .cindex "&%set%& ACL modifier"
 This modifier puts a value into one of the ACL variables (see section
 &<<SECTaclvariables>>&).

+
+
+.vitem &*udpsend*&&~=&~<&'parameters'&>
+This modifier sends a UDP packet, for purposes such as statistics
+collection or behaviour monitoring. The parameters are expanded, and
+the result of the expansion must be a colon-separated list consisting
+of a destination server, port number, and the packet contents. The
+server can be specified as a host name or IPv4 or IPv6 address. The
+separator can be changed with the usual angle bracket syntax. For
+example, you might want to collect information on which hosts connect
+when:
+.code
+udpsend = <; 2001:dB8::dead:beef ; 1234 ;\
+             $tod_zulu $sender_host_address
+.endd

 .endlist
 
 
 .endlist
 
 


@@ -28835,6 +28943,9 @@ following SMTP commands are sent:
 LHLO is used instead of HELO if the transport's &%protocol%& option is
 set to &"lmtp"&.
 
 LHLO is used instead of HELO if the transport's &%protocol%& option is
 set to &"lmtp"&.
 

+The callout may use EHLO, AUTH and/or STARTTLS given appropriate option
+settings.
+

 A recipient callout check is similar. By default, it also uses an empty address
 for the sender. This default is chosen because most hosts do not make use of
 the sender address when verifying a recipient. Using the same address means
 A recipient callout check is similar. By default, it also uses an empty address
 for the sender. This default is chosen because most hosts do not make use of
 the sender address when verifying a recipient. Using the same address means


@@ -34385,14 +34496,14 @@ options are available:
 
 .vlist
 .vitem &*-f*&&~<&'regex'&>
 
 .vlist
 .vitem &*-f*&&~<&'regex'&>

-Match the sender address. The field that is tested is enclosed in angle
-brackets, so you can test for bounce messages with
+Match the sender address using a case-insensitive search. The field that is
+tested is enclosed in angle brackets, so you can test for bounce messages with

 .code
 exiqgrep -f '^<>$'
 .endd
 .vitem &*-r*&&~<&'regex'&>
 .code
 exiqgrep -f '^<>$'
 .endd
 .vitem &*-r*&&~<&'regex'&>

-Match a recipient address. The field that is tested is not enclosed in angle
-brackets.
+Match a recipient address using a case-insensitve search. The field that is
+tested is not enclosed in angle brackets.

 
 .vitem &*-s*&&~<&'regex'&>
 Match against the size field.
 
 .vitem &*-s*&&~<&'regex'&>
 Match against the size field.


@@ -35616,6 +35727,50 @@ are given in chapter &<<CHAPappendfile>>&.
 
 
 
 
 
 

+.section "Running local commands" "SECTsecconslocalcmds"
+There are a number of ways in which an administrator can configure Exim to run
+commands based upon received, untrustworthy, data. Further, in some
+configurations a user who can control a &_.forward_& file can also arrange to
+run commands. Configuration to check includes, but is not limited to:
+
+.ilist
+Use of &%use_shell%& in the pipe transport: various forms of shell command
+injection may be possible with this option present. It is dangerous and should
+be used only with considerable caution. Consider constraints which whitelist
+allowed characters in a variable which is to be used in a pipe transport that
+has &%use_shell%& enabled.
+.next
+A number of options such as &%forbid_filter_run%&, &%forbid_filter_perl%&,
+&%forbid_filter_dlfunc%& and so forth which restrict facilities available to
+&_.forward_& files in a redirect router. If Exim is running on a central mail
+hub to which ordinary users do not have shell access, but home directories are
+NFS mounted (for instance) then administrators should review the list of these
+forbid options available, and should bear in mind that the options that may
+need forbidding can change as new features are added between releases.
+.next
+The &%${run...}%& expansion item does not use a shell by default, but
+administrators can configure use of &_/bin/sh_& as part of the command.
+Such invocations should be viewed with prejudicial suspicion.
+.next
+Administrators who use embedded Perl are advised to explore how Perl's
+taint checking might apply to their usage.
+.next
+Use of &%${expand...}%& is somewhat analagous to shell's eval builtin and
+administrators are well advised to view its use with suspicion, in case (for
+instance) it allows a local-part to contain embedded Exim directives.
+.next
+Use of &%${match_local_part...}%& and friends becomes more dangerous if
+Exim was built with EXPAND_LISTMATCH_RHS defined: the second string in
+each can reference arbitrary lists and files, rather than just being a list
+of opaque strings.
+The EXPAND_LISTMATCH_RHS option was added and set false by default because of
+real-world security vulnerabilities caused by its use with untrustworthy data
+injected in, for SQL injection attacks.
+Consider the use of the &%inlisti%& expansion condition instead.
+.endlist
+
+
+

 .section "IPv4 source routing" "SECID272"
 .cindex "source routing" "in IP packets"
 .cindex "IP source routing"
 .section "IPv4 source routing" "SECID272"
 .cindex "source routing" "in IP packets"
 .cindex "IP source routing"


@@ -36293,7 +36448,7 @@ integer size comparisons against this value.
 A colon-separated list of names of headers included in the signature.
 .vitem &%$dkim_key_testing%&
 "1" if the key record has the "testing" flag set, "0" if not.
 A colon-separated list of names of headers included in the signature.
 .vitem &%$dkim_key_testing%&
 "1" if the key record has the "testing" flag set, "0" if not.

-.vitem &%$nosubdomains%&
+.vitem &%$dkim_key_nosubdomains%&

 "1" if the key record forbids subdomaining, "0" otherwise.
 .vitem &%$dkim_key_srvtype%&
 Service type (tag s=) from the key record. Defaults to "*" if not specified
 "1" if the key record forbids subdomaining, "0" otherwise.
 .vitem &%$dkim_key_srvtype%&
 Service type (tag s=) from the key record. Defaults to "*" if not specified