X-Git-Url: https://git.exim.org/users/heiko/exim.git/blobdiff_plain/1f5b4c3d3200be53a3a6f2bf6791b70fc543b32f..0cd687974f449c03df4125792846b3058a585dab:/doc/doc-txt/NewStuff diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff index bf9890bb3..65b0fc678 100644 --- a/doc/doc-txt/NewStuff +++ b/doc/doc-txt/NewStuff @@ -1,4 +1,4 @@ -$Cambridge: exim/doc/doc-txt/NewStuff,v 1.23 2004/12/22 12:05:45 ph10 Exp $ +$Cambridge: exim/doc/doc-txt/NewStuff,v 1.50 2005/06/16 20:03:43 tom Exp $ New Features in Exim -------------------- @@ -9,836 +9,517 @@ updated when there is a relatively large batch of changes). The doc/ChangeLog file contains a listing of all changes, including bug fixes. -Version 4.50 ------------- - - 1. There is a new build-time option called CONFIGURE_GROUP which works like - CONFIGURE_OWNER. It specifies one additional group that is permitted for - the runtime configuration file when the group write permission is set. - - 2. The "control=submission" facility has a new option /sender_retain. This - has the effect of setting local_sender_retain true and local_from_check - false for the incoming message in which it is encountered. - - 3. $recipients is now available in the predata ACL (oversight). - - 4. The value of address_data from a sender verification is now available in - $sender_address_data in subsequent conditions in the ACL statement. Note: - this is just like $address_data. The value does not persist after the end - of the current ACL statement. If you want to preserve it, you can use one - of the ACL variables. - - 5. The redirect router has two new options: forbid_sieve_filter and - forbid_exim_filter. When filtering is enabled by allow_filter, these - options control which type(s) of filtering are permitted. By default, both - Exim and Sieve filters are allowed. - - 6. A new option for callouts makes it possible to set a different (usually - smaller) timeout for making the SMTP connection. The keyword is "connect". - For example: - - verify = sender/callout=5s,connect=1s - - If not specified, it defaults to the general timeout value. - - 7. The new variables $sender_verify_failure and $recipient_verify_failure - contain information about exactly what failed. In an ACL, after one of - these failures, the relevant variable contains one of the following words: - - qualify the address was unqualified (no domain), and the message - was neither local nor came from an exempted host; - - route routing failed; - - mail routing succeeded, and a callout was attempted; rejection - occurred at or before the MAIL command (that is, on initial - connection, HELO, or MAIL); - - recipient the RCPT command in a callout was rejected; - - postmaster the postmaster check in a callout was rejected. - - The main use of these variables is expected to be to distinguish between - rejections of MAIL and rejections of RCPT. - - 8. The command line option -dd behaves exactly like -d except when used on a - command that starts a daemon process. In that case, debugging is turned off - for the subprocesses that the daemon creates. Thus, it is useful for - monitoring the behaviour of the daemon without creating as much output as - full debugging. - - 9. $host_address is now set to the target address during the checking of - ignore_target_hosts. - -10. There are four new variables called $spool_space, $log_space, - $spool_inodes, and $log_inodes. The first two contain the amount of free - space in the disk partitions where Exim has its spool directory and log - directory, respectively. (When these are in the same partition, the values - will, of course, be the same.) The second two variables contain the numbers - of free inodes in the respective partitions. - - NOTE: Because disks can nowadays be very large, the values in the space - variables are in kilobytes rather than in bytes. Thus, for example, to - check in an ACL that there is at least 50M free on the spool, you would - write: - - condition = ${if > {$spool_space}{50000}{yes}{no}} - - The values are recalculated whenever any of these variables is referenced. - If the relevant file system does not have the concept of inodes, the value - of those variables is -1. If the operating system does not have the ability - to find the amount of free space (only true for experimental systems), the - space value is -1. - -11. It is now permitted to omit both strings after an "if" condition; if the - condition is true, the result is the string "true". As before, when the - second string is omitted, a false condition yields an empty string. This - makes it less cumbersome to write custom ACL and router conditions. For - example, instead of - - condition = ${if eq {$acl_m4}{1}{yes}{no}} - - or the shorter form - - condition = ${if eq {$acl_m4}{1}{yes}} - - (because the second string has always defaulted to ""), you can now write - - condition = ${if eq {$acl_m4}{1}} - - Previously this was a syntax error. - -12. There is a new "record type" that can be specified in dnsdb lookups. It - is "zns" (for "zone NS"). It performs a lookup for NS records on the given - domain, but if none are found, it removes the first component of the domain - name, and tries again. This process continues until NS records are found - or there are no more components left (or there's a DNS error). In other - words, it may return the name servers for a top-level domain, but it never - returns the root name servers. If there are no NS records for the top-level - domain, the lookup fails. - - For example, ${lookup dnsdb{zns=xxx.quercite.com}} returns the name - servers for quercite.com, whereas ${lookup dnsdb{zns=xxx.edu}} returns - the name servers for edu, assuming in each case that there are no NS - records for the full domain name. - - You should be careful about how you use this lookup because, unless the - top-level domain does not exist, the lookup will always return some host - names. The sort of use to which this might be put is for seeing if the name - servers for a given domain are on a blacklist. You can probably assume that - the name servers for the high-level domains such as .com or .co.uk are not - going to be on such a list. - -13. Another new "record type" is "mxh"; this looks up MX records just as "mx" - does, but it returns only the names of the hosts, omitting the priority - values. - -14. It is now possible to specify a list of domains or IP addresses to be - looked up in a dnsdb lookup. The list is specified in the normal Exim way, - with colon as the default separator, but with the ability to change this. - For example: +Exim version 4.52 +----------------- + +TF/01 Support for checking Client SMTP Authorization has been added. CSA is a + system which allows a site to advertise which machines are and are not + permitted to send email. This is done by placing special SRV records in + the DNS, which are looked up using the client's HELO domain. At this + time CSA is still an Internet-Draft. + + Client SMTP Authorization checks are performed by the ACL condition + verify=csa. This will fail if the client is not authorized. If there is + a DNS problem, or if no valid CSA SRV record is found, or if the client + is authorized, the condition succeeds. These three cases can be + distinguished using the expansion variable $csa_status, which can take + one of the values "fail", "defer", "unknown", or "ok". The condition + does not itself defer because that would be likely to cause problems + for legitimate email. + + The error messages produced by the CSA code include slightly more + detail. If $csa_status is "defer" this may be because of problems + looking up the CSA SRV record, or problems looking up the CSA target + address record. There are four reasons for $csa_status being "fail": + the client's host name is explicitly not authorized; the client's IP + address does not match any of the CSA target IP addresses; the client's + host name is authorized but it has no valid target IP addresses (e.g. + the target's addresses are IPv6 and the client is using IPv4); or the + client's host name has no CSA SRV record but a parent domain has + asserted that all subdomains must be explicitly authorized. + + The verify=csa condition can take an argument which is the domain to + use for the DNS query. The default is verify=csa/$sender_helo_name. + + This implementation includes an extension to CSA. If the query domain + is an address literal such as [192.0.2.95], or if it is a bare IP + address, Exim will search for CSA SRV records in the reverse DNS as if + the HELO domain was e.g. 95.2.0.192.in-addr.arpa. Therefore it is + meaningful to say, for example, verify=csa/$sender_host_address - in + fact, this is the check that Exim performs if the client does not say + HELO. This extension can be turned off by setting the main + configuration option dns_csa_use_reverse = false. + + If a CSA SRV record is not found for the domain itself, then a search + is performed through its parent domains for a record which might be + making assertions about subdomains. The maximum depth of this search is + limited using the main configuration option dns_csa_search_limit, which + takes the value 5 by default. Exim does not look for CSA SRV records in + a top level domain, so the default settings handle HELO domains as long + as seven (hostname.five.four.three.two.one.com) which encompasses the + vast majority of legitimate HELO domains. + + The dnsdb lookup also has support for CSA. Although dnsdb already + supports SRV lookups, this is not sufficient because of the extra + parent domain search behaviour of CSA, and (as with PTR lookups) + dnsdb also turns IP addresses into lookups in the reverse DNS space. + The result of ${lookup dnsdb {csa=$sender_helo_name} } has two + space-separated fields: an authorization code and a target host name. + The authorization code can be "Y" for yes, "N" for no, "X" for explicit + authorization required but absent, or "?" for unknown. + +PH/01 The amount of output produced by the "make" process has been reduced, + because the compile lines are often rather long, making it all pretty + unreadable. The new style is along the lines of the 2.6 Linux kernel: + just a short line for each module that is being compiled or linked. + However, it is still possible to get the full output, by calling "make" + like this: + + FULLECHO='' make -e + + The value of FULLECHO defaults to "@", the flag character that suppresses + command reflection in "make". When you ask for the full output, it is + given in addition to the the short output. + +TF/02 There have been two changes concerned with submission mode: + + Until now submission mode always left the return path alone, whereas + locally-submitted messages from untrusted users have the return path + fixed to the user's email address. Submission mode now fixes the return + path to the same address as is used to create the Sender: header. If + /sender_retain is specified then both the Sender: header and the return + path are left alone. + + Note that the changes caused by submission mode take effect after the + predata ACL. This means that any sender checks performed before the + fix-ups will use the untrusted sender address specified by the user, not + the trusted sender address specified by submission mode. Although this + might be slightly unexpected, it does mean that you can configure ACL + checks to spot that a user is trying to spoof another's address, for + example. + + There is also a new /name= option for submission mode which allows you + to specify the user's full name to be included in the Sender: header. + For example: + + accept authenticated = * + control = submission/name=${lookup {$authenticated_id} \ + lsearch {/etc/exim/namelist} } + + The namelist file contains entries like + + fanf: Tony Finch + + And the resulting Sender: header looks like + + Sender: Tony Finch + +TF/03 The control = fakereject ACL modifier now has a fakedefer counterpart, + which works in exactly the same way except it causes a fake SMTP 450 + response after the message data instead of a fake SMTP 550 response. + You must take care when using fakedefer because it will cause messages + to be duplicated when the sender retries. Therefore you should not use + fakedefer if the message will be delivered normally. + +TF/04 There is a new ratelimit ACL condition which can be used to measure + and control the rate at which clients can send email. This is more + powerful than the existing smtp_ratelimit_* options, because those + options only control the rate of commands in a single SMTP session, + whereas the new ratelimit condition works across all connections + (concurrent and sequential) to the same host. + + The syntax of the ratelimit condition is: + + ratelimit = /

/ / + + If the average client sending rate is less than m messages per time + period p then the condition is false, otherwise it is true. + + The parameter p is the smoothing time constant, in the form of an Exim + time interval e.g. 8h for eight hours. A larger time constant means it + takes Exim longer to forget a client's past behaviour. The parameter m is + the maximum number of messages that a client can send in a fast burst. By + increasing both m and p but keeping m/p constant, you can allow a client + to send more messages in a burst without changing its overall sending + rate limit. Conversely, if m and p are both small then messages must be + sent at an even rate. + + The key is used to look up the data used to calcluate the client's + average sending rate. This data is stored in a database maintained by + Exim in its spool directory alongside the retry database etc. For + example, you can limit the sending rate of each authenticated user, + independent of the computer they are sending from, by setting the key + to $authenticated_id. The default key is $sender_host_address. + + Each ratelimit condition can have up to two options. The first option + specifies what Exim measures the rate of, and the second specifies how + Exim handles excessively fast clients. + + The per_mail option means that it measures the client's rate of sending + messages. This is the default if none of the per_* options is specified. + + The per_conn option means that it measures the client's connection rate. + + The per_byte option limits the sender's email bandwidth. Note that it + is best to use this option in the DATA ACL; if it is used in an earlier + ACL it relies on the SIZE parameter on the MAIL command, which may be + inaccurate or completely missing. You can follow the limit m in the + configuration with K, M, or G to specify limits in kilobytes, + megabytes, or gigabytes respectively. + + The per_cmd option means that Exim recomputes the rate every time the + condition is processed, which can be used to limit the SMTP command rate. + The alias per_rcpt is provided for use in the RCPT ACL instead of per_cmd + to make it clear that the effect is to limit the rate at which recipients + are accepted. Note that in this case the rate limiting engine will see a + message with many recipients as a large high-speed burst. + + If a client's average rate is greater than the maximum, the rate + limiting engine can react in two possible ways, depending on the + presence of the strict or leaky options. This is independent of the + other counter-measures (e.g. rejecting the message) that may be + specified by the rest of the ACL. The default mode is leaky, which + avoids a sender's over-aggressive retry rate preventing it from getting + any email through. + + The strict option means that the client's recorded rate is always + updated. The effect of this is that Exim measures the client's average + rate of attempts to send email, which can be much higher than the + maximum. If the client is over the limit it will be subjected to + counter-measures until it slows down below the maximum rate. + + The leaky option means that the client's recorded rate is not updated + if it is above the limit. The effect of this is that Exim measures the + client's average rate of successfully sent email, which cannot be + greater than the maximum. If the client is over the limit it will + suffer some counter-measures, but it will still be able to send email + at the configured maximum rate, whatever the rate of its attempts. + + As a side-effect, the ratelimit condition will set the expansion + variables $sender_rate containing the client's computed rate, + $sender_rate_limit containing the configured value of m, and + $sender_rate_period containing the configured value of p. + + Exim's other ACL facilities are used to define what counter-measures + are taken when the rate limit is exceeded. This might be anything from + logging a warning (e.g. while measuring existing sending rates in order + to define our policy), through time delays to slow down fast senders, + up to rejecting the message. For example, + + # Log all senders' rates + warn + ratelimit = 0 / 1h / strict + log_message = \ + Sender rate $sender_rate > $sender_rate_limit / $sender_rate_period + + # Slow down fast senders + warn + ratelimit = 100 / 1h / per_rcpt / strict + delay = ${eval: 10 * ($sender_rate - $sender_rate_limit) } + + # Keep authenticated users under control + deny + ratelimit = 100 / 1d / strict / $authenticated_id + + # System-wide rate limit + defer + message = Sorry, too busy. Try again later. + ratelimit = 10 / 1s / $primary_hostname + + # Restrict incoming rate from each host, with a default rate limit + # set using a macro and special cases looked up in a table. + defer + message = Sender rate $sender_rate exceeds \ + $sender_rate_limit messages per $sender_rate_period + ratelimit = ${lookup {$sender_host_address} \ + cdb {DB/ratelimits.cdb} \ + {$value} {RATELIMIT} } + +TK/01 Added an 'spf' lookup type that will return an SPF result for a given + email address (the key) and an IP address (the database): + + ${lookup {tom@duncanthrax.net} spf{217.115.139.137}} + + The lookup will return the same result strings as they can appear in + $spf_result (pass,fail,softfail,neutral,none,err_perm,err_temp). The + lookup is armored in EXPERIMENTAL_SPF. Currently, only IPv4 addresses + are supported. + + Patch submitted by Chris Webb . + +PH/02 There's a new verify callout option, "fullpostmaster", which first acts + as "postmaster" and checks the recipient . If that + fails, it tries just , without a domain, in accordance with + the specification in RFC 2821. + +PH/03 The action of the auto_thaw option has been changed. It no longer applies + to frozen bounce messages. + +TK/02 There are two new expansion items to help with the implementation of + the BATV "prvs" scheme in an Exim configuration: + + + ${prvs {

}{}{[KEYNUM]}} + + The "prvs" expansion item takes three arguments: A qualified RFC2821 + email address, a key and an (optional) key number. All arguments are + expanded before being used, so it is easily possible to lookup a key + and key number using the address as the lookup key. The key number is + optional and defaults to "0". The item will expand to a "prvs"-signed + email address, to be typically used with the "return_path" option on + a smtp transport. The decision if BATV should be used with a given + sender/recipient pair should be done on router level, to avoid having + to set "max_rcpt = 1" on the transport. + + + ${prvscheck {
}{}{}} + + The "prvscheck" expansion item takes three arguments. Argument 1 is + expanded first. When the expansion does not yield a SYNTACTICALLY + valid "prvs"-scheme address, the whole "prvscheck" item expands to + the empty string. If
is a "prvs"-encoded address after + expansion, two expansion variables are set up: - ${lookup dnsdb{one.domain.com:two.domain.com}} - ${lookup dnsdb{a=one.host.com:two.host.com}} - ${lookup dnsdb{ptr = <; 1.2.3.4 ; 4.5.6.8}} + $prvscheck_address Contains the "prvs"-decoded version of + the address from argument 1. - In order to retain backwards compatibility, there is one special case: if - the lookup type is PTR and no change of separator is specified, Exim looks - to see if the rest of the string is precisely one IPv6 address. In this - case, it does not treat it as a list. + $prvscheck_keynum Contains the key number extracted from + the "prvs"-address in argument 1. - The data from each lookup is concatenated, with newline separators (by - default - see 14 below), in the same way that multiple DNS records for a - single item are handled. + These two variables can be used in the expansion code of argument 2 + to retrieve the . The VALIDITY of the "prvs"-signed address + is then checked. The result is stored in yet another expansion + variable: - The dnsdb lookup fails only if all the DNS lookups fail. If there is a - temporary DNS error for any of them, the behaviour is controlled by - an optional keyword followed by a comma that may appear before the record - type. The possible keywords are "defer_strict", "defer_never", and - "defer_lax". With "strict" behaviour, any temporary DNS error causes the - whole lookup to defer. With "never" behaviour, a temporary DNS error is - ignored, and the behaviour is as if the DNS lookup failed to find anything. - With "lax" behaviour, all the queries are attempted, but a temporary DNS - error causes the whole lookup to defer only if none of the other lookups - succeed. The default is "lax", so the following lookups are equivalent: + $prvscheck_result Contains the result of a "prvscheck" + expansion: Unset (the empty string) for + failure, "1" for success. - ${lookup dnsdb{defer_lax,a=one.host.com:two.host.com}} - ${lookup dnsdb{a=one.host.com:two.host.com}} + The "prvscheck" expansion expands to the empty string if
+ is not a SYNTACTICALLY valid "prvs"-scheme address. Otherwise, + argument 3 defines what "prvscheck" expands to: If argument 3 + is the empty string, "prvscheck" expands to the decoded version + of the address (no matter if it is CRYPTOGRAPHICALLY valid or not). + If argument 3 expands to a non-empty string, "prvscheck" expands + to that string. - Thus, in the default case, as long as at least one of the DNS lookups - yields some data, the dnsdb lookup succeeds. -15. It is now possible to specify the character to be used as a separator when - a dnsdb lookup returns data from more than one DNS record. The default is a - newline. To specify a different character, put '>' followed by the new - character at the start of the query. For example: + Usage example + ------------- - ${lookup dnsdb{>: a=h1.test.ex:h2.test.ex}} - ${lookup dnsdb{>| mxh=<;m1.test.ex;m2.test.ex}} + Macro: - It is permitted to specify a space as the separator character. Note that - more than one DNS record can be found for a single lookup item; this - feature is relevant even when you do not specify a list. + PRVSCHECK_SQL = ${lookup mysql{SELECT secret FROM batv_prvs WHERE \ + sender='${quote_mysql:$prvscheck_address}'}{$value}} - The same effect could be achieved by wrapping the lookup in ${tr...}; this - feature is just a syntactic simplification. + RCPT ACL: -16. It is now possible to supply a list of domains and/or IP addresses to be - lookup up in a DNS blacklist. Previously, only a single domain name could - be given, for example: + # Bounces: drop unsigned addresses for BATV senders + deny message = This address does not send an unsigned reverse path. + senders = : + recipients = +batv_recipients - dnslists = black.list.tld/$sender_host_name + # Bounces: In case of prvs-signed address, check signature. + deny message = Invalid reverse path signature. + senders = : + condition = ${prvscheck {$local_part@$domain}{PRVSCHECK_SQL}{1}} + !condition = $prvscheck_result - What follows the slash can now be a list. As with all lists, the default - separator is a colon. However, because this is a sublist within the list of - DNS blacklist domains, it is necessary either to double the separators like - this: + Top-Level Router: - dnslists = black.list.tld/name.1::name.2 + batv_redirect: + driver = redirect + data = ${prvscheck {$local_part@$domain}{PRVSCHECK_SQL}{}} - or to change the separator character, like this: + Transport (referenced by router that makes decision if + BATV is applicable): - dnslists = black.list.tld/<;name.1;name.2 + external_smtp_batv: + driver = smtp + return_path = ${prvs {$return_path} \ + {${lookup mysql{SELECT \ + secret FROM batv_prvs WHERE \ + sender='${quote_mysql:$sender_address}'} \ + {$value}fail}}} - If an item in the list is an IP address, it is inverted before the DNS - blacklist domain is appended. If it is not an IP address, no inversion - occurs. Consider this condition: - dnslists = black.list.tls/<;192.168.1.2;a.domain - The DNS lookups that occur are for - - 2.1.168.192.black.list.tld and a.domain.black.list.tld - - Once a DNS record has been found (that matches a specific IP return - address, if specified), no further lookups are done. If there is a - temporary DNS error, the rest of the sublist of domains or IP addresses is - tried. The dnslists item itself defers only if none of the other DNS - lookups in this sublist succeeds. In other words, a successful lookup for - any of the items in the sublist overrides a defer for a previous item. - -17. The log selector queue_time_overall causes Exim to output the time spent on - the queue as an addition to the "Completed" message. Like queue_time (which - puts the queue time on individual delivery lines), the time is tagged with - "QT=", and it is measured from the time that the message starts to be - received, so it includes the reception time. - -18. It is now possible to use both -bF and -bf on the same command, in order to - test a system filter and a user filter in the same run. For example: - - exim -bF /system/filter -bf /user/filter } to the expansion operators. This operator - converts an arbitrary string into one that is base64 encoded. - -10. A new authenticator, called cyrus_sasl, has been added. This requires - the presence of the Cyrus SASL library; it authenticates by calling this - library, which supports a number of authentication mechanisms, including - PLAIN and LOGIN, but also several others that Exim does not support - directly. The code for this authenticator was provided by Matthew - Byng-Maddick of A L Digital Ltd (http://www.aldigital.co.uk). Here follows - draft documentation: - - xx. THE CYRUS_SASL AUTHENTICATOR - - The cyrus_sasl authenticator provides server support for the Cyrus library - Implementation of the RFC 2222 "Simple Authentication and Security Layer". - It provides a gatewaying mechanism directly to the Cyrus interface, so if - your Cyrus library can do, for example, CRAM-MD5, then so can the - cyrus_sasl authenticator. By default it uses the public name of the driver - to determine which mechanism to support. - - Where access to some kind of secret file is required, for example in GSSAPI - or CRAM-MD5, it is worth noting that the authenticator runs as the exim - user, and that the Cyrus SASL library has no way of escalating privileges - by default. You may also find you need to set environment variables, - depending on the driver you are using. - - xx.1 Using cyrus_sasl as a server - - The cyrus_sasl authenticator has four private options. It puts the username - (on a successful authentication) into $1. - - server_hostname Type: string* Default: $primary_hostname - - This option selects the hostname that is used when communicating with - the library. It is up to the underlying SASL plug-in what it does with - this data. - - server_mech Type: string Default: public_name - - This option selects the authentication mechanism this driver should - use. It allows you to use a different underlying mechanism from the - advertised name. For example: - - sasl: - driver = cyrus_sasl - public_name = X-ANYTHING - server_mech = CRAM-MD5 - server_set_id = $1 - - server_realm Type: string Default: unset - - This is the SASL realm that the server is claiming to be in. - - server_service Type: string Default: "smtp" - - This is the SASL service that the server claims to implement. - - For straigthforward cases, you do not need to set any of the - authenticator's private options. All you need to do is to specify an - appropriate mechanism as the public name. Thus, if you have a SASL library - that supports CRAM-MD5 and PLAIN, you might have two authenticators as - follows: - - sasl_cram_md5: - driver = cyrus_sasl - public_name = CRAM-MD5 - server_set_id = $1 - - sasl_plain: - driver = cyrus_sasl - public_name = PLAIN - server_set_id = $1 - -11. There is a new global option called tls_on_connect_ports. Its value must be - a list of port numbers; the most common use is expected to be - - tls_on_connect_ports = 465 - - Setting this option has the same effect as -tls-on-connect on the command - line, but only for the specified ports. It applies to all connections, both - via the daemon and via inetd. You still need to specify all the ports for - the daemon (using daemon_smtp_ports or local_interfaces or the -X command - line option) because this option does not add an extra port -- rather, it - specifies different behaviour on a port that is defined elsewhere. The - -tls-on-connect command line option overrides tls_on_connect_ports, and - forces tls-on-connect for all ports. - -12. There is a new ACL that is run when a DATA command is received, before the - data itself is received. The ACL is defined by acl_smtp_predata. (Compare - acl_smtp_data, which is run after the data has been received.) - This new ACL allows a negative response to be given to the DATA command - itself. Header lines added by MAIL or RCPT ACLs are not visible at this - time, but any that are defined here are visible when the acl_smtp_data ACL - is run. - -13. The "control=submission" ACL modifier has an option "/domain=xxx" which - specifies the domain to be used when creating From: or Sender: lines using - the authenticated id as a local part. If the option is supplied with an - empty domain, that is, just "/domain=", Exim assumes that the authenticated - id is a complete email address, and it uses it as is when creating From: - or Sender: lines. - -14. It is now possible to make retry rules that apply only when the failing - message has a specific sender. In particular, this can be used to define - retry rules that apply only to bounce messages. The syntax is to add a new - third item to a retry rule, of the form "senders=
". The retry - timings themselves then become the fourth item. For example: - - * * senders=: F,1h,30m - - would match all bounce messages. If the address list contains white space, - it must be enclosed in quotes. For example: - - a.domain timeout senders="x@b.dom : y@c.dom" G,8h,10m,1.5 - - When testing retry rules using -brt, you can supply a sender using the -f - command line option, like this: - - exim -f "" -brt user@dom.ain - - If you do not set -f with -brt, a retry rule that contains a senders list - will never be matched. - -15. Two new control modifiers have been added to ACLs: "control = enforce_sync" - and "control = no_enforce_sync". This makes it possible to be selective - about when SMTP synchronization is enforced. The global option - smtp_enforce_sync now specifies the default state of the switch. These - controls can appear in any ACL, but the most obvious place to put them is - in the ACL defined by acl_smtp_connect, which is run at the start of an - incoming SMTP connection, before the first synchronization check. - -16. Another two new control modifiers are "control = caseful_local_part" and - "control = caselower_local_part". These are permitted only in the ACL - specified by acl_smtp_rcpt (i.e. during RCPT processing). By default, the - contents of $local_part are lower cased before ACL processing. - After "control = caseful_local_part", any uppercase letters in the original - local part are restored in $local_part for the rest of the ACL, or until - "control = caselower_local_part" is encountered. However, this applies only - to local part handling that takes place directly in the ACL (for example, - as a key in lookups). If a "verify = recipient" test is obeyed, the - case-related handling of the local part during the verification is - controlled by the router configuration (see the caseful_local_part generic - router option). - - This facility could be used, for example, to add a spam score to local - parts containing upper case letters. For example, using $acl_m4 to - accumulate the spam score: - - warn control = caseful_local_part - set acl_m4 = ${eval:\ - $acl_m4 + \ - ${if match{$local_part}{[A-Z]}{1}{0}}\ - } - control = caselower_local_part - - Notice that we put back the lower cased version afterwards, assuming that - is what is wanted for subsequent tests. - -17. The option hosts_connection_nolog is provided so that certain hosts can be - excepted from logging when the +smtp_connection log selector is set. For - example, you might want not to log SMTP connections from local processes, - or from 127.0.0.1, or from your local LAN. The option is a host list with - an unset default. Because it is consulted in the main loop of the daemon, - you should strive to restrict its value to a short inline list of IP - addresses and networks. To disable logging SMTP connections from local - processes, you must create a host list with an empty item. For example: - - hosts_connection_nolog = : - - If the +smtp_connection log selector is not set, this option has no effect. - -18. There is now an acl called acl_smtp_quit, which is run for the QUIT - command. The outcome of the ACL does not affect the response code to QUIT, - which is always 221. Thus, the ACL does not in fact control any access. - For this reason, the only verbs that are permitted are "accept" and "warn". - - The ACL can be used for tasks such as custom logging at the end of an SMTP - session. For example, you can use ACL variables in other ACLs to count - messages, recipients, etc., and log the totals at QUIT time using one or - more "logwrite" modifiers on a "warn" command. - - You do not need to have a final "accept", but if you do, you can use a - "message" modifier to specify custom text that is sent as part of the 221 - response. - - This ACL is run only for a "normal" QUIT. For certain kinds of disastrous - failure (for example, failure to open a log file, or when Exim is bombing - out because it has detected an unrecoverable error), all SMTP commands - from the client are given temporary error responses until QUIT is received - or the connection is closed. In these special cases, the ACL is not run. - -19. The appendfile transport has two new options, mailbox_size and mailbox_ - filecount. If either these options are set, it is expanded, and the result - is taken as the current size of the mailbox or the number of files in the - mailbox, respectively. This makes it possible to use some external means of - maintaining the data about the size of a mailbox for enforcing quota - limits. The result of expanding these option values must be a decimal - number, optionally followed by "K" or "M". - -20. It seems that there are broken clients in use that cannot handle multiline - SMTP responses. Can't people who implement these braindead programs read? - RFC 821 mentions multiline responses, and it is over 20 years old. They - must handle multiline responses for EHLO, or do they still use HELO? - Anyway, here is YAWFAB (yet another workaround for asinine brokenness). - There's a new ACL switch that can be set by - - control = no_multiline_responses - - If this is set, it suppresses multiline SMTP responses from ACL rejections. - One way of doing this would have been just to put out these responses as - one long line. However, RFC 2821 specifies a maximum of 512 bytes per - response ("use multiline responses for more" it says), and some of the - responses might get close to that. So I have implemented this by doing two - very easy things: - - (1) Extra information that is normally output as part of a rejection - caused by sender verification failure is omitted. Only the final line - (typically "sender verification failed") is now sent. - - (2) If a "message" modifier supplies a multiline response, only the first - line is output. - - The setting of the switch can, of course, be made conditional on the - calling host. - -21. There is now support for the libradius library that comes with FreeBSD. - This is an alternative to the radiusclient library that Exim already - supports. To use the FreeBSD library, you need to set - - RADIUS_LIB_TYPE=RADLIB - - in Local/Makefile, in addition to RADIUS_CONFIGURE_FILE, and you probably - also need -libradius in EXTRALIBS. - - -Version 4.42 ------------- +PH/01 The format in which GnuTLS parameters are written to the gnutls-param + file in the spool directory has been changed. This change has been made + to alleviate problems that some people had with the generation of the + parameters by Exim when /dev/random was exhausted. In this situation, + Exim would hang until /dev/random acquired some more entropy. - 1. The "personal" filter test is brought up-to-date with recommendations from - the Sieve specification: (a) The list of non-personal From: addresses now - includes "listserv", "majordomo", and "*-request"; (b) If the message - contains any header line starting with "List=-" it is treated as - non-personal. + The new code exports and imports the DH and RSA parameters in PEM + format. This means that the parameters can be generated externally using + the certtool command that is part of GnuTLS. - 2. The Sieve functionality has been extended to support the "copy" and - "vacation" extensions, and comparison tests. + To replace the parameters with new ones, instead of deleting the file + and letting Exim re-create it, you can generate new parameters using + certtool and, when this has been done, replace Exim's cache file by + renaming. The relevant commands are something like this: - 3. There is now an overall timeout for performing a callout verification. It - defaults to 4 times the callout timeout, which applies to individual SMTP - commands during the callout. The overall timeout applies when there is more - than one host that can be tried. The timeout is checked before trying the - next host. This prevents very long delays if there are a large number of - hosts and all are timing out (e.g. when the network connections are timing - out). The value of the overall timeout can be changed by specifying an - additional sub-option for "callout", called "maxwait". For example: + # rm -f new.params + # touch new.params + # chown exim:exim new.params + # chmod 0400 new.params + # certtool --generate-privkey --bits 512 >new.params + # echo "" >>new.params + # certtool --generate-dh-params --bits 1024 >> new.params + # mv new.params params - verify = sender/callout=5s,maxwait=20s + If Exim never has to generate the parameters itself, the possibility of + stalling is removed. - 4. Changes to the "personal" filter test: +PH/02 A new expansion item for dynamically loading and calling a locally- + written C function is now provided, if Exim is compiled with - (1) The list of non-personal local parts in From: addresses has been - extended to include "listserv", "majordomo", "*-request", and "owner-*", - taken from the Sieve specification recommendations. + EXPAND_DLFUNC=yes - (2) If the message contains any header line starting with "List-" it is - treated as non-personal. + set in Local/Makefile. The facility is not included by default (a + suitable error is given if you try to use it when it is not there.) - (3) The test for "circular" in the Subject: header line has been removed - because it now seems ill-conceived. - - 5. The autoreply transport has a new option called never_mail. This is an - address list. If any run of the transport creates a message with a - recipient that matches any item in the list, that recipient is quietly - discarded. If all recipients are discarded, no message is created. - - -Version 4.40 ------------- + If you enable EXPAND_DLFUNC, you should also be aware of the new redirect + router option forbid_filter_dlfunc. If you have unprivileged users on + your system who are permitted to create filter files, you might want to + set forbid_filter_dlfunc=true in the appropriate router, to stop them + using ${dlfunc to run code within Exim. -The documentation is up-to-date for the 4.40 release. What follows here is a -brief list of the new features that have been added since 4.30. + You load and call an external function like this: + + ${dlfunc{/some/file}{function}{arg1}{arg2}...} + + Once loaded, Exim remembers the dynamically loaded object so that it + doesn't reload the same object file in the same Exim process (but of + course Exim does start new processes frequently). + + There may be from zero to eight arguments to the function. When compiling + a local function that is to be called in this way, local_scan.h should be + included. The Exim variables and functions that are defined by that API + are also available for dynamically loaded functions. The function itself + must have the following type: + + int dlfunction(uschar **yield, int argc, uschar *argv[]) + + Where "uschar" is a typedef for "unsigned char" in local_scan.h. The + function should return one of the following values: + + OK Success. The string that is placed in "yield" is put into + the expanded string that is being built. + + FAIL A non-forced expansion failure occurs, with the error + message taken from "yield", if it is set. + + FAIL_FORCED A forced expansion failure occurs, with the error message + taken from "yield" if it is set. + + ERROR Same as FAIL, except that a panic log entry is written. + + When compiling a function that is to be used in this way with gcc, + you need to add -shared to the gcc command. Also, in the Exim build-time + configuration, you must add -export-dynamic to EXTRALIBS. + +TF/01 $received_time is a new expansion variable containing the time and date + as a number of seconds since the start of the Unix epoch when the + current message was received. + +PH/03 There is a new value for RADIUS_LIB_TYPE that can be set in + Local/Makefile. It is RADIUSCLIENTNEW, and it requests that the new API, + in use from radiusclient 0.4.0 onwards, be used. It does not appear to be + possible to detect the different versions automatically. + +PH/04 There is a new option called acl_not_smtp_mime that allows you to scan + MIME parts in non-SMTP messages. It operates in exactly the same way as + acl_smtp_mime + +PH/05 It is now possible to redefine a macro within the configuration file. + The macro must have been previously defined within the configuration (or + an included file). A definition on the command line using the -D option + causes all definitions and redefinitions within the file to be ignored. + In other words, -D overrides any values that are set in the file. + Redefinition is specified by using '==' instead of '='. For example: + + MAC1 = initial value + ... + MAC1 == updated value + + Redefinition does not alter the order in which the macros are applied to + the subsequent lines of the configuration file. It is still the same + order in which the macros were originally defined. All that changes is + the macro's value. Redefinition makes it possible to accumulate values. + For example: + + MAC1 = initial value + ... + MAC1 == MAC1 and something added + + This can be helpful in situations where the configuration file is built + from a number of other files. + +PH/06 Macros may now be defined or redefined between router, transport, + authenticator, or ACL definitions, as well as in the main part of the + configuration. They may not, however, be changed within an individual + driver or ACL, or in the local_scan, retry, or rewrite sections of the + configuration. + +PH/07 $acl_verify_message is now set immediately after the failure of a + verification in an ACL, and so is available in subsequent modifiers. In + particular, the message can be preserved by coding like this: - 1. log_incoming_interface affects more log lines. + warn !verify = sender + set acl_m0 = $acl_verify_message - 2. New ACL modifier "control = submission". + Previously, $acl_verify_message was set only while expanding "message" + and "log_message" when a very denied access. - 3. CONFIGURE_OWNER can be set at build time to define an alternative owner for - the configuration file, in addition to root and exim. +PH/08 The redirect router has two new options, sieve_useraddress and + sieve_subaddress. These are passed to a Sieve filter to specify the :user + and :subaddress parts of an address. Both options are unset by default. + However, when a Sieve filter is run, if sieve_useraddress is unset, the + entire original local part (including any prefix or suffix) is used for + :user. An unset subaddress is treated as an empty subaddress. + +PH/09 Quota values can be followed by G as well as K and M. + +PH/10 $message_linecount is a new variable that contains the total number of + lines in the header and body of the message. Compare $body_linecount, + which is the count for the body only. During the DATA and + content-scanning ACLs, $message_linecount contains the number of lines + received. Before delivery happens (that is, before filters, routers, and + transports run) the count is increased to include the Received: header + line that Exim standardly adds, and also any other header lines that are + added by ACLs. The blank line that separates the message header from the + body is not counted. Here is an example of the use of this variable in a + DATA ACL: + + deny message = Too many lines in message header + condition = \ + ${if <{250}{${eval: $message_linecount - $body_linecount}}} + + In the MAIL and RCPT ACLs, the value is zero because at that stage the + message has not yet been received. + +PH/11 In a ${run expansion, the variable $value (which contains the standard + output) is now also usable in the "else" string. + +PH/12 In a pipe transport, although a timeout while waiting for the pipe + process to complete was treated as a delivery failure, a timeout while + writing the message to the pipe was logged, but erroneously treated as a + successful delivery. Such timeouts include transport filter timeouts. For + consistency with the overall process timeout, these timeouts are now + treated as errors, giving rise to delivery failures by default. However, + there is now a new Boolean option for the pipe transport called + timeout_defer, which, if set TRUE, converts the failures into defers for + both kinds of timeout. A transport filter timeout is now identified in + the log output. - 4. Added expansion variables $body_zerocount, $recipient_data, and - $sender_data. - 5. The time of last modification of the "new" subdirectory is now used as the - "mailbox time last read" when there is a quota error for a maildir - delivery. - - 6. The special item "+ignore_unknown" may now appear in host lists. - - 7. The special domain-matching patterns @mx_any, @mx_primary, and - @mx_secondary can now be followed by "/ignore=". - - 8. New expansion conditions: match_domain, match_address, match_local_part, - lt, lti, le, lei, gt, gti, ge, and new expansion operators time_interval, - eval10, and base62d. - - 9. New lookup type called "iplsearch". - -10. New log selectors ident_timeout, tls_certificate_verified, queue_time, - deliver_time, outgoing_port, return_path_on_delivery. - -11. New global options smtp_active_hostname and tls_require_ciphers. - -12. Exinext has -C and -D options. - -13. "domainlist_cache" forces caching of an apparently variable list. - -14. For compatibility with Sendmail, the command line option -prval:sval - is equivalent to -oMr rval -oMs sval. - -15. New callout options use_sender and use_postmaster for use when verifying - recipients. - -16. John Jetmore's "exipick" utility has been added to the distribution. - -17. The TLS code now supports CRLs. - -18. The dnslookup router and the dnsdb lookup type now support the use of SRV - records. - -19. The redirect router has a new option called qualify_domain. - -20. exigrep's output now also includes lines that are not related to any - particular message, but which do match the pattern. +Version 4.50 +------------ -21. New global option write_rejectlog. If it is set false, Exim no longer - writes anything to the reject log. +The documentation is up-to-date for the 4.50 release. ****