X-Git-Url: https://git.exim.org/users/heiko/exim.git/blobdiff_plain/3ecab1575ef1f45a5e7cd3c48cd937ffa8eb0ad9..983207c12082eb01a5a5a0552962de200f231bf4:/doc/doc-txt/experimental-spec.txt diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt index 5dd6832b1..385f0526e 100644 --- a/doc/doc-txt/experimental-spec.txt +++ b/doc/doc-txt/experimental-spec.txt @@ -2,14 +2,42 @@ From time to time, experimental features may be added to Exim. While a feature is experimental, there will be a build-time option whose name starts "EXPERIMENTAL_" that must be set in order to include the feature. This file contains information -about experimenatal features, all of which are unstable and -liable to incompatibile change. +about experimental features, all of which are unstable and +liable to incompatible change. + + +PRDR support +-------------------------------------------------------------- + +Per-Recipient Data Reponse is an SMTP extension proposed by Eric Hall +in a (now-expired) IETF draft from 2007. It's not hit mainstream +use, but has apparently been implemented in the META1 MTA. + +There is mention at http://mail.aegee.org/intern/sendmail.html +of a patch to sendmail "to make it PRDR capable". + + ref: http://www.eric-a-hall.com/specs/draft-hall-prdr-00.txt + +If Exim is built with EXPERIMENTAL_PRDR there is a new config +boolean "prdr_enable" which controls whether PRDR is advertised +as part of an EHLO response, a new "acl_data_smtp_prdr" ACL +(called for each recipient, after data arrives but before the +data ACL), and a new smtp transport option "hosts_try_prdr". + +PRDR may be used to support per-user content filtering. Without it +one must defer any recipient after the first that has a different +content-filter configuration. With PRDR, the RCPT-time check +for this can be disabled when the MAIL-time $smtp_command included +"PRDR". Any required difference in behaviour of the main DATA-time +ACL should however depend on the PRDR-time ACL having run, as Exim +will avoid doing so in some situations (eg. single-recipient mails). + OCSP Stapling support -------------------------------------------------------------- -X509 PKI certificates expire and can be revoked; to handle this, the +X.509 PKI certificates expire and can be revoked; to handle this, the clients need some way to determine if a particular certificate, from a particular Certificate Authority (CA), is still valid. There are three main ways to do so. @@ -41,7 +69,7 @@ starts retrying to fetch an OCSP proof some time before its current proof expires. The downside is that it requires server support. If Exim is built with EXPERIMENTAL_OCSP and it was built with OpenSSL, -then it gains one new option: "tls_ocsp_file". +then it gains a new global option: "tls_ocsp_file". The file specified therein is expected to be in DER format, and contain an OCSP proof. Exim will serve it as part of the TLS handshake. This @@ -58,10 +86,15 @@ next connection. Exim will check for a valid next update timestamp in the OCSP proof; if not present, or if the proof has expired, it will be ignored. +Also, given EXPERIMENTAL_OCSP and OpenSSL, the smtp transport gains +a "hosts_require_ocsp" option; a host-list for which an OCSP Stapling +is requested and required for the connection to proceed. The host(s) +should also be in "hosts_require_tls", and "tls_verify_certificates" +configured for the transport. + At this point in time, we're gathering feedback on use, to determine if it's worth adding complexity to the Exim daemon to periodically re-fetch -OCSP files and somehow handling multiple files. There is no client support -for OCSP in Exim, this is feature expected to be used by mail clients. +OCSP files and somehow handling multiple files. @@ -380,7 +413,7 @@ their default locations. You can now run SPF checks in incoming SMTP by using the "spf" ACL condition in either the MAIL, RCPT or DATA ACLs. When -using it in the RCPT ACL, you can make the checks dependend on +using it in the RCPT ACL, you can make the checks dependent on the RCPT address (or domain), so you can check SPF records only for certain target domains. This gives you the possibility to opt-out certain customers that do not want @@ -491,7 +524,7 @@ reject message. When the spf_guess condition has run, it sets up the same expansion variables as when spf condition is run, described above. -Additionally, since Best-guess is not standarized, you may redefine +Additionally, since Best-guess is not standardized, you may redefine what "Best-guess" means to you by redefining spf_guess variable in global config. For example, the following: @@ -546,7 +579,7 @@ In the DATA ACL you can use the new condition After that "$dcc_header" contains the X-DCC-Header. -Returnvalues are: +Return values are: fail for overall "R", "G" from dccifd defer for overall "T" from dccifd accept for overall "A", "S" from dccifd @@ -570,10 +603,29 @@ through to eg. SpamAssassin. If you want to pass even more headers in the middle of the DATA stage you can set $acl_m_dcc_add_header -to tell the DCC routines add more information; eg, you might set +to tell the DCC routines to add more information; eg, you might set this to some results from ClamAV. Be careful. Header syntax is not checked and is added "as is". +In case you've troubles with sites sending the same queue items from several +hosts and fail to get through greylisting you can use +$acl_m_dcc_override_client_ip + +Setting $acl_m_dcc_override_client_ip to an IP address overrides the default +of $sender_host_address. eg. use the following ACL in DATA stage: + + warn set acl_m_dcc_override_client_ip = \ + ${lookup{$sender_helo_name}nwildlsearch{/etc/mail/multipleip_sites}{$value}{}} + condition = ${if def:acl_m_dcc_override_client_ip} + log_message = dbg: acl_m_dcc_override_client_ip set to \ + $acl_m_dcc_override_client_ip + +Then set something like +# cat /etc/mail/multipleip_sites +mout-xforward.gmx.net 82.165.159.12 +mout.gmx.net 212.227.15.16 + +Use a reasonable IP. eg. one the sending cluster acutally uses. -------------------------------------------------------------- End of file