X-Git-Url: https://git.exim.org/users/heiko/exim.git/blobdiff_plain/049782c0de52a217f78116f82b3a1d69c0667458..12e9bb25fcee27771fb96bda05aa796591f4e4bf:/doc/doc-docbook/spec.xfpt diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index 0632ba26b..d78378c9b 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -2766,6 +2766,8 @@ used to specify a path on the command line if a pid file is required. The SIGHUP signal .cindex "SIGHUP" .cindex "daemon" "restarting" +.cindex signal "to reload configuration" +.cindex daemon "reload configuration" can be used to cause the daemon to re-execute itself. This should be done whenever Exim's configuration file, or any file that is incorporated into it by means of the &%.include%& facility, is changed, and also whenever a new version @@ -6741,6 +6743,12 @@ lookup types support only literal keys. &*Warning 2*&: In a host list, you must always use &(net-iplsearch)& so that the implicit key is the host's IP address rather than its name (see section &<>&). + +.new +&*Warning 3*&: Do not use an IPv4-mapped IPv6 address for a key; use the +IPv4, in dotted-quad form. (Exim converts IPv4-mapped IPv6 addresses to this +notation before executing the lookup.) +.wen .next .new .cindex lookup json @@ -8678,8 +8686,12 @@ to quote keys was made available in &(lsearch)& files. However, the more recently implemented &(iplsearch)& files do require colons in IPv6 keys (notated using the quoting facility) so as to distinguish them from IPv4 keys. For this reason, when the lookup type is &(iplsearch)&, IPv6 addresses are -converted using colons and not dots. In all cases, full, unabbreviated IPv6 +converted using colons and not dots. +.new +In all cases except IPv4-mapped IPv6, full, unabbreviated IPv6 addresses are always used. +The latter are converted to IPv4 addresses, in dotted-quad form. +.wen Ideally, it would be nice to tidy up this anomalous situation by changing to colons in all cases, given that quoting is now available for &(lsearch)&. @@ -9188,6 +9200,7 @@ Many strings in Exim's runtime configuration are expanded before use. Some of them are expanded every time they are used; others are expanded only once. When a string is being expanded it is copied verbatim from left to right except +.cindex expansion "string concatenation" when a dollar or backslash character is encountered. A dollar specifies the start of a portion of the string that is interpreted and replaced as described below in section &<>& onwards. Backslash is used as an @@ -10945,10 +10958,14 @@ returns the SHA-1 hash fingerprint of the certificate. .vitem &*${sha256:*&<&'string'&>&*}*& +.vitem &*${sha2:*&<&'string'&>&*}*& &&& + &*${sha2_:*&<&'string'&>&*}*& .cindex "SHA-256 hash" +.cindex "SHA-2 hash" .cindex certificate fingerprint .cindex "expansion" "SHA-256 hashing" .cindex "&%sha256%& expansion item" +.cindex "&%sha2%& expansion item" The &%sha256%& operator computes the SHA-256 hash value of the string and returns it as a 64-digit hexadecimal number, in which any letters are in upper case. @@ -10956,6 +10973,15 @@ it as a 64-digit hexadecimal number, in which any letters are in upper case. If the string is a single variable of type certificate, returns the SHA-256 hash fingerprint of the certificate. +.new +The operator can also be spelled &%sha2%& and does the same as &%sha256%& +(except for certificates, which are not supported). +Finally, if an underbar +and a number is appended it specifies the output length, selecting a +member of the SHA-2 family of hash functions. +Values of 256, 384 and 512 are accepted, with 256 being the default. +.wen + .vitem &*${sha3:*&<&'string'&>&*}*& &&& &*${sha3_:*&<&'string'&>&*}*& @@ -12170,6 +12196,7 @@ This variable contains the version string of the Exim build. The first character is a major version number, currently 4. Then after a dot, the next group of digits is a minor version number. There may be other characters following the minor version. +This value may be overridden by the &%exim_version%& main config option. .vitem &$header_$&<&'name'&> This is not strictly an expansion variable. It is expansion syntax for @@ -13501,7 +13528,8 @@ Otherwise, empty. .vitem &$version_number$& .vindex "&$version_number$&" -The version number of Exim. +The version number of Exim. Same as &$exim_version$&, may be overridden +by the &%exim_version%& main config option. .vitem &$warn_message_delay$& .vindex "&$warn_message_delay$&" @@ -15332,6 +15360,14 @@ not also supplied, the gid is taken from the result of &[getpwnam()]& if it is used. See chapter &<>& for a discussion of security issues. +.option exim_version main string "current version" +.cindex "Exim version" +.cindex customizing "version number" +.cindex "version number of Exim" override +This option allows to override the &$version_number$&/&$exim_version$& Exim reports in +various places. Use with care, this may fool stupid security scanners. + + .option extra_local_interfaces main "string list" unset This option defines network interfaces that are to be considered local when routing, but which are not used for listening by the daemon. See section @@ -16157,7 +16193,7 @@ harm. This option overrides the &%pipe_as_creator%& option of the &(pipe)& transport driver. -.option openssl_options main "string list" "+no_sslv2 +single_dh_use +no_ticket" +.option openssl_options main "string list" "+no_sslv2 +no_sslv3 +single_dh_use +no_ticket" .cindex "OpenSSL "compatibility options" This option allows an administrator to adjust the SSL options applied by OpenSSL to connections. It is given as a space-separated list of items, @@ -17553,7 +17589,7 @@ use when sending messages as a client, you must set the &%tls_certificate%& option in the relevant &(smtp)& transport. &*Note*&: If you use filenames based on IP addresses, change the list -separator in the usual way (&<>&) >to avoid confusion under IPv6. +separator in the usual way (&<>&) to avoid confusion under IPv6. &*Note*&: Under versions of OpenSSL preceding 1.1.1, when a list of more than one @@ -24556,13 +24592,15 @@ been started will not be passed to a new delivery process for sending another message on the same connection. See section &<>& for an explanation of when this might be needed. -.option hosts_noproxy_tls smtp "host list&!!" * +.new +.option hosts_noproxy_tls smtp "host list&!!" unset .cindex "TLS" "passing connection" .cindex "multiple SMTP deliveries" .cindex "TLS" "multiple message deliveries" For any host that matches this list, a TLS session which has been started will not be passed to a new delivery process for sending another message on the same session. +.wen The traditional implementation closes down TLS and re-starts it in the new process, on the same open TCP connection, for each successive message @@ -28307,7 +28345,7 @@ There is no current way to staple a proof for a client certificate. -.section "Configuring an Exim client to use TLS" "SECID185" +.section "Configuring an Exim client to use TLS" "SECTclientTLS" .cindex "cipher" "logging" .cindex "log" "TLS cipher" .cindex "log" "distinguished name" @@ -30832,7 +30870,7 @@ For SMTP input that does not come over TCP/IP (the &%-bs%& command line option), this condition is always true. -.vitem &*verify&~=&~not_blind*& +.vitem &*verify&~=&~not_blind/*&<&'options'&> .cindex "verifying" "not blind" .cindex "bcc recipients, verifying none" This condition checks that there are no blind (bcc) recipients in the message. @@ -30842,6 +30880,11 @@ case-sensitively; domains are checked case-insensitively. If &'Resent-To:'& or &'Resent-Cc:'& header lines exist, they are also checked. This condition can be used only in a DATA or non-SMTP ACL. +.new +There is one possible option, &`case_insensitive`&. If this is present then +local parts are checked case-insensitively. +.wen + There are, of course, many legitimate messages that make use of blind (bcc) recipients. This check should not be used on its own for blocking messages. @@ -37692,6 +37735,11 @@ Match only frozen messages. .vitem &*-x*& Match only non-frozen messages. + +.new +.vitem &*-G*&&~<&'queuename'&> +Match only messages in the given queue. Without this, the default queue is searched. +.wen .endlist The following options control the format of the output: @@ -39624,8 +39672,9 @@ Signers MUST use RSA keys of at least 1024 bits for all keys. Signers SHOULD use RSA keys of at least 2048 bits. .endd -Support for EC keys is being developed under -&url(https://datatracker.ietf.org/doc/draft-ietf-dcrup-dkim-crypto/). +.new +EC keys for DKIM are defined by RFC 8463. +.wen They are considerably smaller than RSA keys for equivalent protection. As they are a recent development, users should consider dual-signing (by setting a list of selectors, and an expansion for this option) @@ -39645,10 +39694,12 @@ openssl pkey -outform DER -pubout -in dkim_ed25519.private | tail -c +13 | base6 certtool --load_privkey=dkim_ed25519.private --pubkey_info --outder | tail -c +13 | base64 .endd -Note that the format -of Ed25519 keys in DNS has not yet been decided; this release supports -both of the leading candidates at this time, a future release will -probably drop support for whichever proposal loses. +.new +Exim also supports an alternate format +of Ed25519 keys in DNS which was a candidate during development +of the standard, but not adopted. +A future release will probably drop that support. +.wen .option dkim_hash smtp string&!! sha256 Can be set to any one of the supported hash methods, which are: