Fix docs for utf8clean

[users/heiko/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index f29c38722ccb6e90a9461553b28b6e04e11c6ce2..09220857d137625a7147686d36992047726cdbeb 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -52,7 +52,7 @@
 .set I   "    "
 
 .macro copyyear
 .set I   "    "
 
 .macro copyyear

-2013
+2014

 .endmacro
 
 . /////////////////////////////////////////////////////////////////////////////
 .endmacro
 
 . /////////////////////////////////////////////////////////////////////////////


@@ -10171,6 +10171,14 @@ number of larger units and output in Exim's normal time format, for example,
 .cindex "expansion" "case forcing"
 .cindex "&%uc%& expansion item"
 This forces the letters in the string into upper-case.
 .cindex "expansion" "case forcing"
 .cindex "&%uc%& expansion item"
 This forces the letters in the string into upper-case.

+
+.vitem &*${utf8clean:*&<&'string'&>&*}*&
+.cindex "correction of invalid utf-8 sequences in strings"
+.cindex "utf-8" "utf-8 sequences"
+.cindex "incorrect utf-8"
+.cindex "expansion" "utf-8 forcing"
+.cindex "&%utf8clean%& expansion item"
+This replaces any invalid utf-8 sequence in the string by the character &`?`&.

 .endlist
 
 
 .endlist
 
 


@@ -11978,7 +11986,7 @@ other times, this variable is false.
 It is likely that you will need to coerce DNSSEC support on in the resolver
 library, by setting:
 .code
 It is likely that you will need to coerce DNSSEC support on in the resolver
 library, by setting:
 .code

-dns_use_dnssec = 1
+dns_dnssec_ok = 1

 .endd
 
 Exim does not perform DNSSEC validation itself, instead leaving that to a
 .endd
 
 Exim does not perform DNSSEC validation itself, instead leaving that to a


@@ -13190,10 +13198,10 @@ See also the &'Policy controls'& section above.
 .row &%disable_ipv6%&                "do no IPv6 processing"
 .row &%dns_again_means_nonexist%&    "for broken domains"
 .row &%dns_check_names_pattern%&     "pre-DNS syntax check"
 .row &%disable_ipv6%&                "do no IPv6 processing"
 .row &%dns_again_means_nonexist%&    "for broken domains"
 .row &%dns_check_names_pattern%&     "pre-DNS syntax check"

+.row &%dns_dnssec_ok%&               "parameter for resolver"

 .row &%dns_ipv4_lookup%&             "only v4 lookup for these domains"
 .row &%dns_retrans%&                 "parameter for resolver"
 .row &%dns_retry%&                   "parameter for resolver"
 .row &%dns_ipv4_lookup%&             "only v4 lookup for these domains"
 .row &%dns_retrans%&                 "parameter for resolver"
 .row &%dns_retry%&                   "parameter for resolver"

-.row &%dns_use_dnssec%&              "parameter for resolver"

 .row &%dns_use_edns0%&               "parameter for resolver"
 .row &%hold_domains%&                "hold delivery for these domains"
 .row &%local_interfaces%&            "for routing checks"
 .row &%dns_use_edns0%&               "parameter for resolver"
 .row &%hold_domains%&                "hold delivery for these domains"
 .row &%local_interfaces%&            "for routing checks"


@@ -13814,6 +13822,17 @@ This option controls whether or not an IP address, given as a CSA domain, is
 reversed and looked up in the reverse DNS, as described in more detail in
 section &<<SECTverifyCSA>>&.
 
 reversed and looked up in the reverse DNS, as described in more detail in
 section &<<SECTverifyCSA>>&.
 

+
+.option dns_dnssec_ok main integer -1
+.cindex "DNS" "resolver options"
+.cindex "DNS" "DNSSEC"
+If this option is set to a non-negative number then Exim will initialise the
+DNS resolver library to either use or not use DNSSEC, overriding the system
+default. A value of 0 coerces DNSSEC off, a value of 1 coerces DNSSEC on.
+
+If the resolver library does not support DNSSEC then this option has no effect.
+
+

 .option dns_ipv4_lookup main "domain list&!!" unset
 .cindex "IPv6" "DNS lookup for AAAA records"
 .cindex "DNS" "IPv6 lookup for AAAA records"
 .option dns_ipv4_lookup main "domain list&!!" unset
 .cindex "IPv6" "DNS lookup for AAAA records"
 .cindex "DNS" "IPv6 lookup for AAAA records"


@@ -13844,16 +13863,6 @@ to set in them.
 See &%dns_retrans%& above.
 
 
 See &%dns_retrans%& above.
 
 

-.option dns_use_dnssec main integer -1
-.cindex "DNS" "resolver options"
-.cindex "DNS" "DNSSEC"
-If this option is set to a non-negative number then Exim will initialise the
-DNS resolver library to either use or not use DNSSEC, overriding the system
-default. A value of 0 coerces DNSSEC off, a value of 1 coerces DNSSEC on.
-
-If the resolver library does not support DNSSEC then this option has no effect.
-
-

 .option dns_use_edns0 main integer -1
 .cindex "DNS" "resolver options"
 .cindex "DNS" "EDNS0"
 .option dns_use_edns0 main integer -1
 .cindex "DNS" "resolver options"
 .cindex "DNS" "EDNS0"


@@ -27292,7 +27301,12 @@ It is usable in the RCPT ACL and valid only for single-recipient mails forwarded
 from one SMTP connection to another.  If a recipient-verify callout connection is
 requested in the same ACL it is held open and used for the data, otherwise one is made
 after the ACL completes.
 from one SMTP connection to another.  If a recipient-verify callout connection is
 requested in the same ACL it is held open and used for the data, otherwise one is made
 after the ACL completes.

-Note that routers are used in verify mode.
+
+Note that routers are used in verify mode.  Note also that headers cannot be
+modified by any of the post-data ACLs (DATA, MIME and DKIM).
+Cutthrough delivery is not supported via transport-filters or when DKIM signing
+of outgoing messages is done, because it sends data to the ultimate destination
+before the entire message has been received from the source.

 
 Should the ultimate destination system positively accept or reject the mail,
 a corresponding indication is given to the source system and nothing is queued.
 
 Should the ultimate destination system positively accept or reject the mail,
 a corresponding indication is given to the source system and nothing is queued.


@@ -27546,12 +27560,15 @@ warn dnslists = sbl.spamhaus.org : \
      add_header = X-blacklisted-at: $dnslist_domain
 .endd
 The &%add_header%& modifier is permitted in the MAIL, RCPT, PREDATA, DATA,
      add_header = X-blacklisted-at: $dnslist_domain
 .endd
 The &%add_header%& modifier is permitted in the MAIL, RCPT, PREDATA, DATA,

-MIME, and non-SMTP ACLs (in other words, those that are concerned with
+MIME, DKIM, and non-SMTP ACLs (in other words, those that are concerned with

 receiving a message). The message must ultimately be accepted for
 &%add_header%& to have any significant effect. You can use &%add_header%& with
 any ACL verb, including &%deny%& (though this is potentially useful only in a
 RCPT ACL).
 
 receiving a message). The message must ultimately be accepted for
 &%add_header%& to have any significant effect. You can use &%add_header%& with
 any ACL verb, including &%deny%& (though this is potentially useful only in a
 RCPT ACL).
 

+Headers will not be added to the message if the modifier is used in
+DATA, MIME or DKIM ACLs for messages delivered by cutthrough routing.
+

 Leading and trailing newlines are removed from
 the data for the &%add_header%& modifier; if it then
 contains one or more newlines that
 Leading and trailing newlines are removed from
 the data for the &%add_header%& modifier; if it then
 contains one or more newlines that


@@ -27645,12 +27662,15 @@ warn   message        = Remove internal headers
        remove_header  = x-route-mail1 : x-route-mail2
 .endd
 The &%remove_header%& modifier is permitted in the MAIL, RCPT, PREDATA, DATA,
        remove_header  = x-route-mail1 : x-route-mail2
 .endd
 The &%remove_header%& modifier is permitted in the MAIL, RCPT, PREDATA, DATA,

-MIME, and non-SMTP ACLs (in other words, those that are concerned with
+MIME, DKIM, and non-SMTP ACLs (in other words, those that are concerned with

 receiving a message). The message must ultimately be accepted for
 &%remove_header%& to have any significant effect. You can use &%remove_header%&
 with any ACL verb, including &%deny%&, though this is really not useful for
 any verb that doesn't result in a delivered message.
 
 receiving a message). The message must ultimately be accepted for
 &%remove_header%& to have any significant effect. You can use &%remove_header%&
 with any ACL verb, including &%deny%&, though this is really not useful for
 any verb that doesn't result in a delivered message.
 

+Headers will not be removed to the message if the modifier is used in
+DATA, MIME or DKIM ACLs for messages delivered by cutthrough routing.
+

 More than one header can be removed at the same time by using a colon separated
 list of header names. The header matching is case insensitive. Wildcards are
 not permitted, nor is list expansion performed, so you cannot use hostlists to
 More than one header can be removed at the same time by using a colon separated
 list of header names. The header matching is case insensitive. Wildcards are
 not permitted, nor is list expansion performed, so you cannot use hostlists to


@@ -27971,6 +27991,23 @@ This condition checks whether the sending host (the client) is authorized to
 send email. Details of how this works are given in section
 &<<SECTverifyCSA>>&.
 
 send email. Details of how this works are given in section
 &<<SECTverifyCSA>>&.
 

+.new
+.vitem &*verify&~=&~header_names_ascii*&
+.cindex "&%verify%& ACL condition"
+.cindex "&ACL;" "verifying header names only ASCII"
+.cindex "header lines" "verifying header names only ASCII"
+.cindex "verifying" "header names only ASCII"
+This condition is relevant only in an ACL that is run after a message has been
+received, that is, in an ACL specified by &%acl_smtp_data%& or
+&%acl_not_smtp%&.  It checks all header names (not the content) to make sure
+there are no non-ASCII characters, also excluding control characters.  The
+allowable characters are decimal ASCII values 33 through 126.
+
+Exim itself will handle headers with non-ASCII characters, but it can cause
+problems for downstream applications, so this option will allow their
+detection and rejection in the DATA ACL's.
+.wen
+

 .vitem &*verify&~=&~header_sender/*&<&'options'&>
 .cindex "&%verify%& ACL condition"
 .cindex "&ACL;" "verifying sender in the header"
 .vitem &*verify&~=&~header_sender/*&<&'options'&>
 .cindex "&%verify%& ACL condition"
 .cindex "&ACL;" "verifying sender in the header"


@@ -28582,6 +28619,13 @@ deny   condition = ${if isip4{$sender_host_address}}
        dnslists  = some.list.example
 .endd
 
        dnslists  = some.list.example
 .endd
 

+If an explicit key is being used for a DNS lookup and it may be an IPv6
+address you should specify alternate list separators for both the outer
+(DNS list name) list and inner (lookup keys) list:
+.code
+       dnslists = <; dnsbl.example.com/<|$acl_m_addrslist
+.endd
+

 .section "Rate limiting incoming messages" "SECTratelimiting"
 .cindex "rate limiting" "client sending"
 .cindex "limiting client sending rates"
 .section "Rate limiting incoming messages" "SECTratelimiting"
 .cindex "rate limiting" "client sending"
 .cindex "limiting client sending rates"


@@ -34321,7 +34365,8 @@ The message that is written is &"spool file is locked"&.
 .next
 .cindex "log" "smtp confirmation"
 .cindex "SMTP" "logging confirmation"
 .next
 .cindex "log" "smtp confirmation"
 .cindex "SMTP" "logging confirmation"

-&%smtp_confirmation%&: The response to the final &"."& in the SMTP dialogue for
+.cindex "LMTP" "logging confirmation"
+&%smtp_confirmation%&: The response to the final &"."& in the SMTP or LMTP dialogue for

 outgoing messages is added to delivery log lines in the form &`C=`&<&'text'&>.
 A number of MTAs (including Exim) return an identifying string in this
 response.
 outgoing messages is added to delivery log lines in the form &`C=`&<&'text'&>.
 A number of MTAs (including Exim) return an identifying string in this
 response.


@@ -36338,7 +36383,9 @@ disabled by setting DISABLE_DKIM=yes in Local/Makefile.
 Exim's DKIM implementation allows to
 .olist
 Sign outgoing messages: This function is implemented in the SMTP transport.
 Exim's DKIM implementation allows to
 .olist
 Sign outgoing messages: This function is implemented in the SMTP transport.

-It can co-exist with all other Exim features, including transport filters.
+It can co-exist with all other Exim features
+(including transport filters)
+except cutthrough delivery.

 .next
 Verify signatures in incoming messages: This is implemented by an additional
 ACL (acl_smtp_dkim), which can be called several times per message, with
 .next
 Verify signatures in incoming messages: This is implemented by an additional
 ACL (acl_smtp_dkim), which can be called several times per message, with


@@ -36429,6 +36476,10 @@ used.
 Verification of DKIM signatures in incoming email is implemented via the
 &%acl_smtp_dkim%& ACL. By default, this ACL is called once for each
 syntactically(!) correct signature in the incoming message.
 Verification of DKIM signatures in incoming email is implemented via the
 &%acl_smtp_dkim%& ACL. By default, this ACL is called once for each
 syntactically(!) correct signature in the incoming message.

+A missing ACL definition defaults to accept.
+If any ACL call does not acccept, the message is not accepted.
+If a cutthrough delivery was in progress for the message it is
+summarily dropped (having wasted the transmission effort).

 
 To evaluate the signature in the ACL a large number of expansion variables
 containing the signature status and its details are set up during the
 
 To evaluate the signature in the ACL a large number of expansion variables
 containing the signature status and its details are set up during the