Updated Avast scanner interface. Bug 1033

[users/heiko/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 89fb5841e9cf392238b53a545f019dc75a61f416..df648d932dd2d661569b7fad92fc3d04cdd1d7e3 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -11259,6 +11259,17 @@ The building process for Exim keeps a count of the number
 of times it has been compiled. This serves to distinguish different
 compilations of the same version of the program.
 
 of times it has been compiled. This serves to distinguish different
 compilations of the same version of the program.
 

+.vitem &$config_dir$&
+.vindex "&$config_dir$&"
+The directory name of the main configuration file. That is, the content of
+&$config_file$& with the last component stripped. The value does not
+contain the trailing slash. If &$config_file$& does not contain a slash,
+&$config_dir$& is ".".
+
+.vitem &$config_file$&
+.vindex "&$config_file$&"
+The name of the main configuration file Exim is using.
+

 .vitem &$demime_errorlevel$&
 .vindex "&$demime_errorlevel$&"
 This variable is available when Exim is compiled with
 .vitem &$demime_errorlevel$&
 .vindex "&$demime_errorlevel$&"
 This variable is available when Exim is compiled with


@@ -11366,6 +11377,13 @@ This variable contains the path to the Exim binary.
 .vindex "&$exim_uid$&"
 This variable contains the numerical value of the Exim user id.
 
 .vindex "&$exim_uid$&"
 This variable contains the numerical value of the Exim user id.
 

+.vitem &$exim_version$&
+.vindex "&$exim_uid$&"
+This variable contains the version string of the Exim build.
+The first character is a major version number, currently 4.
+Then after a dot, the next group of digits is a minor version number.
+There may be other characters following the minor version.
+

 .vitem &$found_extension$&
 .vindex "&$found_extension$&"
 This variable is available when Exim is compiled with the
 .vitem &$found_extension$&
 .vindex "&$found_extension$&"
 This variable is available when Exim is compiled with the


@@ -15640,13 +15658,15 @@ the time of delivery. They are normally used only for final local deliveries.
 This option is an obsolete synonym for &%bounce_return_size_limit%&.
 
 
 This option is an obsolete synonym for &%bounce_return_size_limit%&.
 
 

-.option rfc1413_hosts main "host list&!!" *
+.option rfc1413_hosts main "host list&!!" @[]

 .cindex "RFC 1413"
 .cindex "host" "for RFC 1413 calls"
 .cindex "RFC 1413"
 .cindex "host" "for RFC 1413 calls"

-RFC 1413 identification calls are made to any client host which matches an item
-in the list.
+RFC 1413 identification calls are made to any client host which matches
+an item in the list.
+The default value specifies just this host, being any local interface
+for the system.

 
 

-.option rfc1413_query_timeout main time 5s
+.option rfc1413_query_timeout main time 0s

 .cindex "RFC 1413" "query timeout"
 .cindex "timeout" "for RFC 1413 call"
 This sets the timeout on RFC 1413 identification calls. If it is set to zero,
 .cindex "RFC 1413" "query timeout"
 .cindex "timeout" "for RFC 1413 call"
 This sets the timeout on RFC 1413 identification calls. If it is set to zero,


@@ -16494,7 +16514,7 @@ preference order of the available ciphers. Details are given in sections
 See &%tls_verify_hosts%& below.
 
 
 See &%tls_verify_hosts%& below.
 
 

-.option tls_verify_certificates main string&!! unset
+.option tls_verify_certificates main string&!! system

 .cindex "TLS" "client certificate verification"
 .cindex "certificate" "verification of client"
 The value of this option is expanded, and must then be either the
 .cindex "TLS" "client certificate verification"
 .cindex "certificate" "verification of client"
 The value of this option is expanded, and must then be either the


@@ -16505,7 +16525,8 @@ match &%tls_verify_hosts%& or &%tls_try_verify_hosts%&.
 
 The "system" value for the option will use a
 system default location compiled into the SSL library.
 
 The "system" value for the option will use a
 system default location compiled into the SSL library.

-This is not available for GnuTLS versions preceding 3.0.20 and an explicit location
+This is not available for GnuTLS versions preceding 3.0.20,
+and will be taken as empty; an explicit location

 must be specified.
 
 The use of a directory for the option value is not avilable for GnuTLS versions
 must be specified.
 
 The use of a directory for the option value is not avilable for GnuTLS versions


@@ -23445,7 +23466,7 @@ unknown state), opens a new one to the same host, and then tries the delivery
 in clear.
 
 
 in clear.
 
 

-.option tls_try_verify_hosts smtp "host list&!!" unset
+.option tls_try_verify_hosts smtp "host list&!!" *

 .cindex "TLS" "server certificate verification"
 .cindex "certificate" "verification of server"
 This option gives a list of hosts for which, on encrypted connections,
 .cindex "TLS" "server certificate verification"
 .cindex "certificate" "verification of server"
 This option gives a list of hosts for which, on encrypted connections,


@@ -23471,7 +23492,7 @@ limited to being the initial component of a 3-or-more component FQDN.
 There is no equivalent checking on client certificates.
 
 
 There is no equivalent checking on client certificates.
 
 

-.option tls_verify_certificates smtp string&!! unset
+.option tls_verify_certificates smtp string&!! system

 .cindex "TLS" "server certificate verification"
 .cindex "certificate" "verification of server"
 .vindex "&$host$&"
 .cindex "TLS" "server certificate verification"
 .cindex "certificate" "verification of server"
 .vindex "&$host$&"


@@ -23483,7 +23504,8 @@ a file or directory containing permitted certificates for servers,
 for use when setting up an encrypted connection.
 
 The "system" value for the option will use a location compiled into the SSL library.
 for use when setting up an encrypted connection.
 
 The "system" value for the option will use a location compiled into the SSL library.

-This is not available for GnuTLS versions preceding 3.0.20 and an explicit location
+This is not available for GnuTLS versions preceding 3.0.20; a value of "system"
+is taken as empty and an explicit location

 must be specified.
 
 The use of a directory for the option value is not avilable for GnuTLS versions
 must be specified.
 
 The use of a directory for the option value is not avilable for GnuTLS versions


@@ -23500,6 +23522,7 @@ expansion of this option. See chapter &<<CHAPTLS>>& for details of TLS.
 
 For back-compatability,
 if neither tls_verify_hosts nor tls_try_verify_hosts are set
 
 For back-compatability,
 if neither tls_verify_hosts nor tls_try_verify_hosts are set

+(a single-colon empty list counts as being set)

 and certificate verification fails the TLS connection is closed.
 
 
 and certificate verification fails the TLS connection is closed.
 
 


@@ -26492,7 +26515,7 @@ if it requests it. If the server is Exim, it will request a certificate only if
 &%tls_verify_hosts%& or &%tls_try_verify_hosts%& matches the client.
 
 If the &%tls_verify_certificates%& option is set on the &(smtp)& transport, it
 &%tls_verify_hosts%& or &%tls_try_verify_hosts%& matches the client.
 
 If the &%tls_verify_certificates%& option is set on the &(smtp)& transport, it

-specified a collection of expected server certificates.
+specifies a collection of expected server certificates.

 These may be the system default set (depeding on library version),
 a file or,
 depnding on liibrary version, a directory,
 These may be the system default set (depeding on library version),
 a file or,
 depnding on liibrary version, a directory,


@@ -30305,6 +30328,39 @@ The usual list-parsing of the content (see &<<SECTlistconstruct>>&) applies.
 The following scanner types are supported in this release:
 
 .vlist
 The following scanner types are supported in this release:
 
 .vlist

+.vitem &%avast%&
+.cindex "virus scanners" "avast"
+This is the scanner daemon of Avast. It has been tested with Avast Core
+Security (currenty at version 1.1.7).
+You can get a trial version at &url(http://www.avast.com) or for Linux
+at &url(http://www.avast.com/linux-server-antivirus).
+This scanner type takes one option,
+which can be either a full path to a UNIX socket,
+or host and port specifiers separated by white space.
+The host may be a name or an IP address; the port is either a
+single number or a pair of numbers with a dash between.
+Any further options are given, on separate lines,
+to the daemon as options before the main scan command.
+For example:
+.code
+av_scanner = avast:/var/run/avast/scan.sock:FLAGS -fullfiles:SENSITIVITY -pup
+av_scanner = avast:192.168.2.22 5036
+.endd
+If you omit the argument, the default path
+&_/var/run/avast/scan.sock_&
+is used.
+If you use a remote host,
+you need to make Exim's spool directory available to it,
+as the scanner is passed a file path, not file contents.
+For information about available commands and their options you may use 
+.code
+$ socat UNIX:/var/run/avast/scan.sock STDIO:
+    FLAGS
+    SENSITIVITY
+    PACK
+.endd
+
+

 .vitem &%aveserver%&
 .cindex "virus scanners" "Kaspersky"
 This is the scanner daemon of Kaspersky Version 5. You can get a trial version
 .vitem &%aveserver%&
 .cindex "virus scanners" "Kaspersky"
 This is the scanner daemon of Kaspersky Version 5. You can get a trial version


@@ -30393,9 +30449,13 @@ av_scanner = cmdline:\
 .endd
 .vitem &%drweb%&
 .cindex "virus scanners" "DrWeb"
 .endd
 .vitem &%drweb%&
 .cindex "virus scanners" "DrWeb"

-The DrWeb daemon scanner (&url(http://www.sald.com/)) interface takes one
-argument, either a full path to a UNIX socket, or an IP address and port
-separated by white space, as in these examples:
+The DrWeb daemon scanner (&url(http://www.sald.com/)) interface
+takes one option,
+either a full path to a UNIX socket,
+or host and port specifiers separated by white space.
+The host may be a name or an IP address; the port is either a
+single number or a pair of numbers with a dash between.
+For example:

 .code
 av_scanner = drweb:/var/run/drwebd.sock
 av_scanner = drweb:192.168.2.20 31337
 .code
 av_scanner = drweb:/var/run/drwebd.sock
 av_scanner = drweb:192.168.2.20 31337


@@ -34810,7 +34870,7 @@ selection marked by asterisks:
 &` smtp_protocol_error        `&  SMTP protocol errors
 &` smtp_syntax_error          `&  SMTP syntax errors
 &` subject                    `&  contents of &'Subject:'& on <= lines
 &` smtp_protocol_error        `&  SMTP protocol errors
 &` smtp_syntax_error          `&  SMTP syntax errors
 &` subject                    `&  contents of &'Subject:'& on <= lines

-&` tls_certificate_verified   `&  certificate verification status
+&`*tls_certificate_verified   `&  certificate verification status

 &`*tls_cipher                 `&  TLS cipher suite on <= and => lines
 &` tls_peerdn                 `&  TLS peer DN on <= and => lines
 &` tls_sni                    `&  TLS SNI on <= lines
 &`*tls_cipher                 `&  TLS cipher suite on <= and => lines
 &` tls_peerdn                 `&  TLS peer DN on <= and => lines
 &` tls_sni                    `&  TLS SNI on <= lines