of times it has been compiled. This serves to distinguish different
compilations of the same version of the program.
+.vitem &$config_dir$&
+.vindex "&$config_dir$&"
+The directory name of the main configuration file. That is, the content of
+&$config_file$& with the last component stripped. The value does not
+contain the trailing slash. If &$config_file$& does not contain a slash,
+&$config_dir$& is ".".
+
+.vitem &$config_file$&
+.vindex "&$config_file$&"
+The name of the main configuration file Exim is using.
+
.vitem &$demime_errorlevel$&
.vindex "&$demime_errorlevel$&"
This variable is available when Exim is compiled with
.vindex "&$exim_uid$&"
This variable contains the numerical value of the Exim user id.
+.vitem &$exim_version$&
+.vindex "&$exim_uid$&"
+This variable contains the version string of the Exim build.
+The first character is a major version number, currently 4.
+Then after a dot, the next group of digits is a minor version number.
+There may be other characters following the minor version.
+
.vitem &$found_extension$&
.vindex "&$found_extension$&"
This variable is available when Exim is compiled with the
processed and the message itself has been received, but before the final
acknowledgment is sent. See chapter &<<CHAPACL>>& for further details.
-.option acl_smtp_data_prdr main string&!! unset
-.cindex "DATA" "ACL for"
+.option acl_smtp_data_prdr main string&!! accept
+.cindex "PRDR" "ACL for"
+.cindex "DATA" "PRDR ACL for"
.cindex "&ACL;" "PRDR-related"
.cindex "&ACL;" "per-user data processing"
This option defines the ACL that,
This option is an obsolete synonym for &%bounce_return_size_limit%&.
-.option rfc1413_hosts main "host list&!!" *
+.option rfc1413_hosts main "host list&!!" @[]
.cindex "RFC 1413"
.cindex "host" "for RFC 1413 calls"
-RFC 1413 identification calls are made to any client host which matches an item
-in the list.
+RFC 1413 identification calls are made to any client host which matches
+an item in the list.
+The default value specifies just this host, being any local interface
+for the system.
-.option rfc1413_query_timeout main time 5s
+.option rfc1413_query_timeout main time 0s
.cindex "RFC 1413" "query timeout"
.cindex "timeout" "for RFC 1413 call"
This sets the timeout on RFC 1413 identification calls. If it is set to zero,
See &%tls_verify_hosts%& below.
-.option tls_verify_certificates main string&!! unset
+.option tls_verify_certificates main string&!! system
.cindex "TLS" "client certificate verification"
.cindex "certificate" "verification of client"
-The value of this option is expanded, and must then be the absolute path to
-a file containing permitted certificates for clients that
-match &%tls_verify_hosts%& or &%tls_try_verify_hosts%&. Alternatively, if you
-are using either GnuTLS version 3.3.6 (or later) or OpenSSL,
-you can set &%tls_verify_certificates%& to the name of a
-directory containing certificate files.
-For earlier versions of GnuTLS
-the option must be set to the name of a single file.
+The value of this option is expanded, and must then be either the
+word "system"
+or the absolute path to
+a file or directory containing permitted certificates for clients that
+match &%tls_verify_hosts%& or &%tls_try_verify_hosts%&.
+
+The "system" value for the option will use a
+system default location compiled into the SSL library.
+This is not available for GnuTLS versions preceding 3.0.20,
+and will be taken as empty; an explicit location
+must be specified.
+
+The use of a directory for the option value is not avilable for GnuTLS versions
+preceding 3.3.6 and a single file must be used.
+
+With OpenSSL the certificates specified
+explicitly
+either by file or directory
+are added to those given by the system default location.
These certificates should be for the certificate authorities trusted, rather
than the public cert of individual clients. With both OpenSSL and GnuTLS, if
the value is a file then the certificates are sent by Exim as a server to
connecting clients, defining the list of accepted certificate authorities.
Thus the values defined should be considered public data. To avoid this,
-use OpenSSL with a directory.
+use the explicit directory version.
See &<<SECTtlssni>>& for discussion of when this option might be re-expanded.
unauthenticated. See also &%hosts_require_auth%&, and chapter
&<<CHAPSMTPAUTH>>& for details of authentication.
-.option hosts_try_prdr smtp "host list&!!" unset
+.option hosts_try_prdr smtp "host list&!!" *
.cindex "PRDR" "enabling, optional in client"
This option provides a list of servers to which, provided they announce
PRDR support, Exim will attempt to negotiate PRDR
for multi-recipient messages.
+The option can usually be left as default.
.option interface smtp "string list&!!" unset
.cindex "bind IP address"
permits this.
-.option multi_domain smtp boolean true
+.option multi_domain smtp boolean&!! true
.vindex "&$domain$&"
When this option is set, the &(smtp)& transport can handle a number of
addresses containing a mixture of different domains provided they all resolve
&$domain$& in an expansion for the transport, because it is set only when there
is a single domain involved in a remote delivery.
+It is expanded per-address and can depend on any of
+&$address_data$&, &$domain_data$&, &$local_part_data$&,
+&$host$&, &$host_address$& and &$host_port$&.
.option port smtp string&!! "see below"
.cindex "port" "sending TCP/IP"
in clear.
-.option tls_try_verify_hosts smtp "host list&!! unset
+.option tls_try_verify_hosts smtp "host list&!!" *
.cindex "TLS" "server certificate verification"
.cindex "certificate" "verification of server"
This option gives a list of hosts for which, on encrypted connections,
The &%tls_verify_certificates%& option must also be set.
Note that unless the host is in this list
TLS connections will be denied to hosts using self-signed certificates
-when &%tls_verify_certificates%& is set.
+when &%tls_verify_certificates%& is matched.
The &$tls_out_certificate_verified$& variable is set when
certificate verification succeeds.
-.option tls_verify_certificates smtp string&!! unset
+.option tls_verify_cert_hostnames smtp "host list&!!" *
+.cindex "TLS" "server certificate hostname verification"
+.cindex "certificate" "verification of server"
+This option give a list of hosts for which,
+while verifying the server certificate,
+checks will be included on the host name
+(note that this will generally be the result of a DNS MX lookup)
+versus Subject and Subject-Alternate-Name fields. Wildcard names are permitted
+limited to being the initial component of a 3-or-more component FQDN.
+
+There is no equivalent checking on client certificates.
+
+
+.option tls_verify_certificates smtp string&!! system
.cindex "TLS" "server certificate verification"
.cindex "certificate" "verification of server"
.vindex "&$host$&"
.vindex "&$host_address$&"
-The value of this option must be the absolute path to a file containing
-permitted server certificates, for use when setting up an encrypted connection.
-Alternatively,
-if you are using either GnuTLS version 3.3.6 (or later) or OpenSSL,
-you can set
-&%tls_verify_certificates%& to the name of a directory containing certificate
-files.
-For earlier versions of GnuTLS the option must be set to the name of a
-single file.
+The value of this option must be either the
+word "system"
+or the absolute path to
+a file or directory containing permitted certificates for servers,
+for use when setting up an encrypted connection.
+
+The "system" value for the option will use a location compiled into the SSL library.
+This is not available for GnuTLS versions preceding 3.0.20; a value of "system"
+is taken as empty and an explicit location
+must be specified.
+
+The use of a directory for the option value is not avilable for GnuTLS versions
+preceding 3.3.6 and a single file must be used.
+
+With OpenSSL the certificates specified
+explicitly
+either by file or directory
+are added to those given by the system default location.
+
The values of &$host$& and
&$host_address$& are set to the name and address of the server during the
expansion of this option. See chapter &<<CHAPTLS>>& for details of TLS.
For back-compatability,
if neither tls_verify_hosts nor tls_try_verify_hosts are set
+(a single-colon empty list counts as being set)
and certificate verification fails the TLS connection is closed.
-.option tls_verify_hosts smtp "host list&!! unset
+.option tls_verify_hosts smtp "host list&!!" unset
.cindex "TLS" "server certificate verification"
.cindex "certificate" "verification of server"
This option gives a list of hosts for which. on encrypted connections,
There are some differences in usage when using GnuTLS instead of OpenSSL:
.ilist
-The &%tls_verify_certificates%& option must contain the name of a file, not the
-name of a directory for GnuTLS versions before 3.3.6
+The &%tls_verify_certificates%& option
+cannot be the path of a directory
+for GnuTLS versions before 3.3.6
(for later versions, or OpenSSL, it can be either).
.next
The default value for &%tls_dhparam%& differs for historical reasons.
apply to all TLS connections. For any host that matches one of these options,
Exim requests a certificate as part of the setup of the TLS session. The
contents of the certificate are verified by comparing it with a list of
-expected certificates. These must be available in a file or,
-for OpenSSL only (not GnuTLS), a directory, identified by
+expected certificates.
+These may be the system default set (depending on library version),
+an explicit file or,
+depending on library version, a directory, identified by
&%tls_verify_certificates%&.
A file can contain multiple certificates, concatenated end to end. If a
&%tls_verify_hosts%& or &%tls_try_verify_hosts%& matches the client.
If the &%tls_verify_certificates%& option is set on the &(smtp)& transport, it
+specifies a collection of expected server certificates.
+These may be the system default set (depeding on library version),
+a file or,
+depnding on liibrary version, a directory,
must name a file or,
-for OpenSSL only (not GnuTLS), a directory, that contains a collection of
-expected server certificates. The client verifies the server's certificate
+for OpenSSL only (not GnuTLS), a directory.
+The client verifies the server's certificate
against this collection, taking into account any revoked certificates that are
in the list defined by &%tls_crl%&.
Failure to verify fails the TLS connection unless either of the
.section "The SMTP PRDR ACL" "SECTPRDRACL"
+.cindex "PRDR" "ACL for"
.oindex "&%prdr_enable%&"
The &%acl_smtp_data_prdr%& ACL is available only when Exim is compiled
with PRDR support enabled (which is the default).
has been accepted.
The ACL test specfied by &%acl_smtp_data_prdr%& happens after a message
-has been recieved, and is executed for each recipient of the message.
-The test may accept or deny for inividual recipients.
+has been recieved, and is executed once for each recipient of the message
+with &$local_part$& and &$domain$& valid.
+The test may accept, defer or deny for inividual recipients.
The &%acl_smtp_data%& will still be called after this ACL and
can reject the message overall, even if this ACL has accepted it
for some or all recipients.
The following scanner types are supported in this release:
.vlist
+.vitem &%avast%&
+.cindex "virus scanners" "avast"
+This is the scanner daemon of Avast version 1.1.7 and 1.1.6
+(as reported by "/bin/avast -v").
+You can get a trial version at &url(http://www.avast.com).
+This scanner type requires one option,
+either a full path to a UNIX socket,
+or host and port specifiers separated by white space.
+The host may a name or an IP address; the port is either a
+single number or a pair of numbers with a dash between.
+Any further options are given, on separate lines,
+to the daemon as options before the main scan command.
+For example:
+.code
+av_scanner = avast:/var/run/avast4/local.sock:FLAGS -fullfiles:SENSITIVITY -pup
+av_scanner = avast:192.168.2.22 5036
+.endd
+If you omit the argument, the default path
+&_/var/run/avast4/local.sock_&
+is used.
+If you use a remote host,
+you need to make Exim's spool directory available to it,
+as the scanner is passed a file path, not file contents.
+
+
.vitem &%aveserver%&
.cindex "virus scanners" "Kaspersky"
This is the scanner daemon of Kaspersky Version 5. You can get a trial version
.endd
.vitem &%drweb%&
.cindex "virus scanners" "DrWeb"
-The DrWeb daemon scanner (&url(http://www.sald.com/)) interface takes one
-argument, either a full path to a UNIX socket, or an IP address and port
-separated by white space, as in these examples:
+The DrWeb daemon scanner (&url(http://www.sald.com/)) interface
+takes one option,
+either a full path to a UNIX socket,
+or host and port specifiers separated by white space.
+The host may be a name or an IP address; the port is either a
+single number or a pair of numbers with a dash between.
+For example:
.code
av_scanner = drweb:/var/run/drwebd.sock
av_scanner = drweb:192.168.2.20 31337
&` smtp_protocol_error `& SMTP protocol errors
&` smtp_syntax_error `& SMTP syntax errors
&` subject `& contents of &'Subject:'& on <= lines
-&` tls_certificate_verified `& certificate verification status
+&`*tls_certificate_verified `& certificate verification status
&`*tls_cipher `& TLS cipher suite on <= and => lines
&` tls_peerdn `& TLS peer DN on <= and => lines
&` tls_sni `& TLS SNI on <= lines
git://git.exim.org / users / heiko / exim.git / blobdiff