X-Git-Url: https://git.exim.org/users/heiko/exim.git/blobdiff_plain/5b881b5a8e0d7bc540f4b63cc9559d2cb1775965..9ac22119716d965a167beaa3f98e0569ca9ff3d7:/doc/doc-docbook/spec.xfpt diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index e1eaf3f70..7e59c304d 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -1575,7 +1575,7 @@ If a host is unreachable for a period of time, a number of messages may be waiting for it by the time it recovers, and sending them in a single SMTP connection is clearly beneficial. Whenever a delivery to a remote host is deferred, -.cindex "hints database" +.cindex "hints database" "deferred deliveries" Exim makes a note in its hints database, and whenever a successful SMTP delivery has happened, it looks to see if any other messages are waiting for the same host. If any are found, they are sent over the same SMTP @@ -1860,7 +1860,7 @@ described RFC 2047. This makes it possible to transmit characters that are not in the ASCII character set, and to label them as being in a particular character set. When Exim is inspecting header lines by means of the &%$h_%& mechanism, it decodes them, and translates them into a specified character set -(default ISO-8859-1). The translation is possible only if the operating system +(default is set at build time). The translation is possible only if the operating system supports the &[iconv()]& function. However, some of the operating systems that supply &[iconv()]& do not support @@ -3107,8 +3107,12 @@ users, the output is as in this example: .code mysql_servers = .endd -If &%configure_file%& is given as an argument, the name of the run time -configuration file is output. +If &%config%& is given as an argument, the config is +output, as it was parsed, any include file resolved, any comment removed. + +If &%config_file%& is given as an argument, the name of the run time +configuration file is output. (&%configure_file%& works too, for +backward compatibility.) If a list of configuration files was supplied, the value that is output here is the name of the file that was actually used. @@ -3548,6 +3552,9 @@ example: exim '-D ABC = something' ... .endd &%-D%& may be repeated up to 10 times on a command line. +.new +Only macro names up to 22 letters long can be set. +.wen .vitem &%-d%&<&'debug&~options'&> @@ -4800,8 +4807,8 @@ help with this. See the comments in &_src/EDITME_& for details. Exim's configuration file is divided into a number of different parts. General option settings must always appear at the start of the file. The other parts are all optional, and may appear in any order. Each part other than the first -is introduced by the word &"begin"& followed by the name of the part. The -optional parts are: +is introduced by the word &"begin"& followed by at least one literal +space, and the name of the part. The optional parts are: .ilist &'ACL'&: Access control lists for controlling incoming SMTP mail (see chapter @@ -6060,7 +6067,7 @@ address_pipe: .endd This transport is used for handling deliveries to pipes that are generated by redirection (aliasing or users' &_.forward_& files). The &%return_output%& -option specifies that any output on stdout or stderr generated by the pipe is to +option specifies that any output on stdout or stderr generated by the pipe is to be returned to the sender. .code address_file: @@ -6617,6 +6624,14 @@ password value. For example: &(pgsql)&: The format of the query is an SQL statement that is passed to a PostgreSQL database. See section &<>&. +.next +.new +.cindex "Redis lookup type" +.cindex lookup Redis +&(redis)&: The format of the query is an SQL statement that is passed to a +Redis database. See section &<>&. +.wen + .next .cindex "sqlite lookup type" .cindex "lookup" "sqlite" @@ -6993,6 +7008,15 @@ Retries for the dnsdb lookup can be controlled by a retry modifier. The form if &"retry_VAL"& where VAL is an integer. The default count is set by the main configuration option &%dns_retry%&. +.new +.cindex cacheing "of dns lookup" +.cindex TTL "of dns lookup" +.cindex DNS TTL +Dnsdb lookup results are cached within a single process (and its children). +The cache entry lifetime is limited to the smallest time-to-live (TTL) +value of the set of returned DNS records. +.wen + .section "Pseudo dnsdb record types" "SECID66" .cindex "MX record" "in &(dnsdb)& lookup" @@ -7298,6 +7322,8 @@ The value of the DEREFERENCE parameter must be one of the words &"never"&, must be &"follow"& (the default) or &"nofollow"&. The latter stops the LDAP library from trying to follow referrals issued by the LDAP server. +.cindex LDAP timeout +.cindex timeout "LDAP lookup" The name CONNECT is an obsolete name for NETTIME, retained for backwards compatibility. This timeout (specified as a number of seconds) is enforced from the client end for operations that can be carried out over a @@ -7312,7 +7338,7 @@ The TIME parameter (also a number of seconds) is passed to the server to set a server-side limit on the time taken to complete a search. The SERVERS parameter allows you to specify an alternate list of ldap servers -to use for an individual lookup. The global ldap_servers option provides a +to use for an individual lookup. The global &%ldap_default_servers%& option provides a default list of ldap servers, and a single lookup can specify a single ldap server to use. But when you need to do a lookup with a list of servers that is different than the default list (maybe different order, maybe a completely @@ -7372,7 +7398,7 @@ SMTP authentication. See the &%ldapauth%& expansion string condition in chapter The &(ldapdn)& lookup type returns the Distinguished Name from a single entry as a sequence of values, for example .code -cn=manager, o=University of Cambridge, c=UK +cn=manager,o=University of Cambridge,c=UK .endd The &(ldap)& lookup type generates an error if more than one entry matches the search filter, whereas &(ldapm)& permits this case, and inserts a newline in @@ -7383,7 +7409,8 @@ directory. In the common case where you specify a single attribute in your LDAP query, the result is not quoted, and does not contain the attribute name. If the attribute -has multiple values, they are separated by commas. +has multiple values, they are separated by commas. Any comma that is +part of an attribute's value is doubled. If you specify multiple attributes, the result contains space-separated, quoted strings, each preceded by the attribute name and an equals sign. Within the @@ -7398,7 +7425,9 @@ same as specifying all of an entry's attributes. Here are some examples of the output format. The first line of each pair is an LDAP query, and the second is the data that is returned. The attribute called &%attr1%& has two values, one of them with an embedded comma, whereas -&%attr2%& has only one value: +&%attr2%& has only one value. Both attributes are derived from &%attr%& +(they have SUP &%attr%& in their schema definitions). + .code ldap:///o=base?attr1?sub?(uid=fred) value1.1,value1,,2 @@ -7406,6 +7435,9 @@ value1.1,value1,,2 ldap:///o=base?attr2?sub?(uid=fred) value two +ldap:///o=base?attr?sub?(uid=fred) +value1.1,value1,,2,value two + ldap:///o=base?attr1,attr2?sub?(uid=fred) attr1="value1.1,value1,,2" attr2="value two" @@ -7465,7 +7497,10 @@ operator is to double any quote characters within the text. .cindex "lookup" "Oracle" .cindex "InterBase lookup type" .cindex "lookup" "InterBase" -Exim can support lookups in InterBase, MySQL, Oracle, PostgreSQL, and SQLite +.cindex "Redis lookup type" +.cindex lookup Redis +Exim can support lookups in InterBase, MySQL, Oracle, PostgreSQL, Redis, +and SQLite databases. Queries for these databases contain SQL statements, so an example might be .code @@ -7492,7 +7527,7 @@ If the result of the query yields more than one row, it is all concatenated, with a newline between the data for each row. -.section "More about MySQL, PostgreSQL, Oracle, and InterBase" "SECID72" +.section "More about MySQL, PostgreSQL, Oracle, InterBase, and Redis" "SECID72" .cindex "MySQL" "lookup type" .cindex "PostgreSQL lookup type" .cindex "lookup" "MySQL" @@ -7501,13 +7536,18 @@ with a newline between the data for each row. .cindex "lookup" "Oracle" .cindex "InterBase lookup type" .cindex "lookup" "InterBase" -If any MySQL, PostgreSQL, Oracle, or InterBase lookups are used, the -&%mysql_servers%&, &%pgsql_servers%&, &%oracle_servers%&, or &%ibase_servers%& +.cindex "Redis lookup type" +.cindex lookup Redis +If any MySQL, PostgreSQL, Oracle, InterBase or Redis lookups are used, the +&%mysql_servers%&, &%pgsql_servers%&, &%oracle_servers%&, &%ibase_servers%&, +or &%redis_servers%& option (as appropriate) must be set to a colon-separated list of server information. -(For MySQL and PostgreSQL only, the global option need not be set if all +(For MySQL and PostgreSQL, the global option need not be set if all queries contain their own server information &-- see section -&<>&.) Each item in the list is a slash-separated list of four +&<>&.) +For all but Redis +each item in the list is a slash-separated list of four items: host name, database name, user name, and password. In the case of Oracle, the host name field is used for the &"service name"&, and the database name field is not used and should be empty. For example: @@ -7528,16 +7568,36 @@ a query is successfully processed. The result of a query may be that no data is found, but that is still a successful query. In other words, the list of servers provides a backup facility, not a list of different places to look. +.new +For Redis the global option need not be specified if all queries contain their +own server information &-- see section &<>&. +If specified, the option must be set to a colon-separated list of server +information. +Each item in the list is a slash-separated list of three items: +host, database number, and password. +.olist +The host is required and may be either an IPv4 address and optional +port number (separated by a colon, which needs doubling due to the +higher-level list), or a Unix socket pathname enclosed in parentheses +.next +The database number is optional; if present that number is selected in the backend +.next +The password is optional; if present it is used to authenticate to the backend +.endlist +.wen + +.new The &%quote_mysql%&, &%quote_pgsql%&, and &%quote_oracle%& expansion operators convert newline, tab, carriage return, and backspace to \n, \t, \r, and \b respectively, and the characters single-quote, double-quote, and backslash -itself are escaped with backslashes. The &%quote_pgsql%& expansion operator, in -addition, escapes the percent and underscore characters. This cannot be done -for MySQL because these escapes are not recognized in contexts where these -characters are not special. +itself are escaped with backslashes. + +The &%quote_redis%& expansion operator +escapes whitespace and backslash characters with a backslash. +.wen .section "Specifying the server in the query" "SECTspeserque" -For MySQL and PostgreSQL lookups (but not currently for Oracle and InterBase), +For MySQL, PostgreSQL and Redis lookups (but not currently for Oracle and InterBase), it is possible to specify a list of servers with an individual query. This is done by starting the query with .display @@ -7580,13 +7640,17 @@ ${lookup pgsql{servers=master/db/name/pw; UPDATE ...} } .section "Special MySQL features" "SECID73" For MySQL, an empty host name or the use of &"localhost"& in &%mysql_servers%& causes a connection to the server on the local host by means of a Unix domain -socket. An alternate socket can be specified in parentheses. The full syntax of -each item in &%mysql_servers%& is: +socket. An alternate socket can be specified in parentheses. +.new +An option group name for MySQL option files can be specified in square brackets; +the default value is &"exim"&. +.wen +The full syntax of each item in &%mysql_servers%& is: .display -<&'hostname'&>::<&'port'&>(<&'socket name'&>)/<&'database'&>/&&& - <&'user'&>/<&'password'&> +<&'hostname'&>::<&'port'&>(<&'socket name'&>)[<&'option group'&>]/&&& + <&'database'&>/<&'user'&>/<&'password'&> .endd -Any of the three sub-parts of the first field can be omitted. For normal use on +Any of the four sub-parts of the first field can be omitted. For normal use on the local host it can be left blank or set to just &"localhost"&. No database need be supplied &-- but if it is absent here, it must be given in @@ -7638,6 +7702,8 @@ domainlist relay_to_domains = sqlite;/some/thing/sqlitedb \ The only character affected by the &%quote_sqlite%& operator is a single quote, which it doubles. +.cindex timeout SQLite +.cindex sqlite "lookup timeout" The SQLite library handles multiple simultaneous accesses to the database internally. Multiple readers are permitted, but only one process can update at once. Attempts to access the database while it is being updated @@ -9264,10 +9330,11 @@ by earlier ACLs are visible. Upper case and lower case letters are synonymous in header names. If the following character is white space, the terminating colon may be omitted, but this is not recommended, because you may then forget it when it is needed. When -white space terminates the header name, it is included in the expanded string. -If the message does not contain the given header, the expansion item is -replaced by an empty string. (See the &%def%& condition in section -&<>& for a means of testing for the existence of a header.) +white space terminates the header name, this white space is included in the +expanded string. If the message does not contain the given header, the +expansion item is replaced by an empty string. (See the &%def%& condition in +section &<>& for a means of testing for the existence of a +header.) If there is more than one header with the same name, they are all concatenated to form the substitution string, up to a maximum length of 64K. Unless @@ -9343,6 +9410,19 @@ you can use condition = ${if >{$acl_m4}{3}} .endd + + +.new +.vitem &*${imapfolder{*&<&'foldername'&>&*}}*& +.cindex expansion "imap folder" +.cindex "&%imapfolder%& expansion item" +This item converts a (possibly multilevel, or with non-ASCII characters) +folder specification to a Maildir name for filesystem use. +For information on internationalisation support see &<>&. +.wen + + + .vitem &*${length{*&<&'string1'&>&*}{*&<&'string2'&>&*}}*& .cindex "expansion" "string truncation" .cindex "&%length%& expansion item" @@ -9389,7 +9469,7 @@ yields &"42"&, and .code ${listextract{-3}{<, x,42,99,& Mailer,,/bin/bash}{result: $value}} .endd -yields &"result: 99"&. +yields &"result: 42"&. If {<&'string3'&>} is omitted, an empty string is used for string3. If {<&'string2'&>} is also omitted, the value that was @@ -10098,6 +10178,27 @@ as is, and other byte values are converted to &`\xNN`&, for example a byte value 127 is converted to &`\x7f`&. +.new +.vitem &*${ipv6denorm:*&<&'string'&>&*}*& +.cindex "&%ipv6denorm%& expansion item" +.cindex "IP address" normalisation +This expands an IPv6 address to a full eight-element colon-separated set +of hex digits including leading zeroes. +A trailing ipv4-style dotted-decimal set is converted to hex. +Pure IPv4 addresses are converted to IPv4-mapped IPv6. + +.vitem &*${ipv6norm:*&<&'string'&>&*}*& +.cindex "&%ipv6norm%& expansion item" +.cindex "IP address" normalisation +.cindex "IP address" "canonical form" +This converts an IPv6 address to canonical form. +Leading zeroes of groups are omitted, and the longest +set of zero-valued groups is replaced with a double colon. +A trailing ipv4-style dotted-decimal set is converted to hex. +Pure IPv4 addresses are converted to IPv4-mapped IPv6. +.wen + + .vitem &*${lc:*&<&'string'&>&*}*& .cindex "case forcing in strings" .cindex "string" "case forcing" @@ -10181,11 +10282,14 @@ Letters in IPv6 addresses are always output in lower case. .vitem &*${md5:*&<&'string'&>&*}*& .cindex "MD5 hash" .cindex "expansion" "MD5 hash" -.cindex "certificate fingerprint" +.cindex certificate fingerprint .cindex "&%md5%& expansion item" The &%md5%& operator computes the MD5 hash value of the string, and returns it as a 32-digit hexadecimal number, in which any letters are in lower case. +If the string is a single variable of type certificate, +returns the MD5 hash fingerprint of the certificate. + .vitem &*${nhash_*&<&'n'&>&*_*&<&'m'&>&*:*&<&'string'&>&*}*& .cindex "expansion" "numeric hash" @@ -10281,7 +10385,7 @@ f.7.2.0.0.0.0.c.d.c.b.a.1.0.0.0.9.0.0.0.2.4.c.0.8.b.d.0.1.0.0.2 This operator encodes text according to the rules of RFC 2047. This is an encoding that is used in header lines to encode non-ASCII characters. It is assumed that the input string is in the encoding specified by the -&%headers_charset%& option, which defaults to ISO-8859-1. If the string +&%headers_charset%& option, which gets its default at build time. If the string contains only characters in the range 33&--126, and no instances of the characters .code @@ -10319,15 +10423,18 @@ variables or headers inside regular expressions. .vitem &*${sha1:*&<&'string'&>&*}*& .cindex "SHA-1 hash" .cindex "expansion" "SHA-1 hashing" -.cindex "certificate fingerprint" +.cindex certificate fingerprint .cindex "&%sha2%& expansion item" The &%sha1%& operator computes the SHA-1 hash value of the string, and returns it as a 40-digit hexadecimal number, in which any letters are in upper case. +If the string is a single variable of type certificate, +returns the SHA-1 hash fingerprint of the certificate. + .vitem &*${sha256:*&<&'certificate'&>&*}*& .cindex "SHA-256 hash" -.cindex "certificate fingerprint" +.cindex certificate fingerprint .cindex "expansion" "SHA-256 hashing" .cindex "&%sha256%& expansion item" The &%sha256%& operator computes the SHA-256 hash fingerprint of the @@ -10413,6 +10520,23 @@ This forces the letters in the string into upper-case. .cindex "expansion" "utf-8 forcing" .cindex "&%utf8clean%& expansion item" This replaces any invalid utf-8 sequence in the string by the character &`?`&. + +.new +.vitem "&*${utf8_domain_to_alabel:*&<&'string'&>&*}*&" &&& + "&*${utf8_domain_from_alabel:*&<&'string'&>&*}*&" &&& + "&*${utf8_localpart_to_alabel:*&<&'string'&>&*}*&" &&& + "&*${utf8_localpart_from_alabel:*&<&'string'&>&*}*&" +.cindex expansion UTF-8 +.cindex UTF-8 expansion +.cindex EAI +.cindex internationalisation +.cindex "&%utf8_domain_to_alabel%& expansion item" +.cindex "&%utf8_domain_from_alabel%& expansion item" +.cindex "&%utf8_localpart_to_alabel%& expansion item" +.cindex "&%utf8_localpart_from_alabel%& expansion item" +These convert EAI mail name components between UTF-8 and a-label forms. +For information on internationalisation support see &<>&. +.wen .endlist @@ -11109,7 +11233,8 @@ support for TLS or the content scanning extension. When a &%match%& expansion condition succeeds, these variables contain the captured substrings identified by the regular expression during subsequent processing of the success string of the containing &%if%& expansion item. -However, they do not retain their values afterwards; in fact, their previous +In the expansion condition case +they do not retain their values afterwards; in fact, their previous values are restored at the end of processing an &%if%& item. The numerical variables may also be set externally by some other matching process which precedes the expansion of the string. For example, the commands available in @@ -11208,7 +11333,7 @@ this variable holds the pipe command when the transport is running. .vitem "&$auth1$& &-- &$auth3$&" .vindex "&$auth1$&, &$auth2$&, etc" These variables are used in SMTP authenticators (see chapters -&<>&&--&<>&). Elsewhere, they are empty. +&<>&&--&<>&). Elsewhere, they are empty. .vitem &$authenticated_id$& .cindex "authentication" "id" @@ -11317,9 +11442,10 @@ not the same as the user id of the originator of a message (see &$originator_uid$&). If Exim re-execs itself, this variable in the new incarnation normally contains the Exim uid. -.vitem &$compile_date$& -.vindex "&$compile_date$&" -The date on which the Exim binary was compiled. +.vitem &$callout_address$& +.vindex "&$callout_address$&" +After a callout for verification, spamd or malware daemon service, the +address that was connected to. .vitem &$compile_number$& .vindex "&$compile_number$&" @@ -11368,7 +11494,8 @@ see section &<>&. &$dkim_key_nosubdomains$& &&& &$dkim_key_srvtype$& &&& &$dkim_key_granularity$& &&& - &$dkim_key_notes$& + &$dkim_key_notes$& &&& + &$dkim_key_length$& These variables are only available within the DKIM ACL. For details see chapter &<>&. @@ -11978,6 +12105,24 @@ a single-component name, Exim calls &[gethostbyname()]& (or qualified host name. See also &$smtp_active_hostname$&. +.new +.vitem &$proxy_host_address$& &&& + &$proxy_host_port$& &&& + &$proxy_target_address$& &&& + &$proxy_target_port$& &&& + &$proxy_session$& +These variables are only available when built with Proxy Protocol +or Socks5 support +For details see chapter &<>&. +.wen + +.new +.vitem &$prdr_requested$& +.cindex "PRDR" "variable for" +This variable is set to &"yes"& if PRDR was requested by the client for the +current message, otherwise &"no"&. +.wen + .vitem &$prvscheck_address$& This variable is used in conjunction with the &%prvscheck%& expansion item, which is described in sections &<>& and @@ -12156,6 +12301,12 @@ increases for each accepted recipient. It can be referenced in an ACL. This variable is set to contain the matching regular expression after a &%regex%& ACL condition has matched (see section &<>&). +.vitem "&$regex1$&, &$regex2$&, etc" +.cindex "regex submatch variables (&$1regex$& &$2regex$& etc)" +When a &%regex%& or &%mime_regex%& ACL condition succeeds, +these variables contain the +captured substrings identified by the regular expression. + .vitem &$reply_address$& .vindex "&$reply_address$&" @@ -12529,6 +12680,7 @@ If TLS has not been negotiated, the value will be 0. .vitem &$tls_in_ourcert$& .vindex "&$tls_in_ourcert$&" +.cindex certificate veriables This variable refers to the certificate presented to the peer of an inbound connection when the message was received. It is only useful as the argument of a @@ -12619,6 +12771,7 @@ See &$tls_in_ocsp$& for values. .vitem &$tls_in_peerdn$& .vindex "&$tls_in_peerdn$&" .vindex "&$tls_peerdn$&" +.cindex certificate "extracting fields" When a message is received from a remote host over an encrypted SMTP connection, and Exim is configured to request a certificate from the client, the value of the Distinguished Name of the certificate is made available in the @@ -13261,6 +13414,7 @@ listed in more than one group. .section "Logging" "SECID99" .table2 +.row &%event_action%& "custom logging" .row &%hosts_connection_nolog%& "exemption from connect logging" .row &%log_file_path%& "override compiled-in value" .row &%log_selector%& "set/unset optional logging" @@ -13402,6 +13556,7 @@ listed in more than one group. .row &%helo_verify_hosts%& "HELO hard-checked for these hosts" .row &%host_lookup%& "host name looked up for these hosts" .row &%host_lookup_order%& "order of DNS and local name lookups" +.row &%hosts_proxy%& "use proxy protocol for these hosts" .row &%host_reject_connection%& "reject connection from these hosts" .row &%hosts_treat_as_local%& "useful in some cluster configurations" .row &%local_scan_timeout%& "timeout for &[local_scan()]&" @@ -13536,6 +13691,7 @@ See also the &'Policy controls'& section above. .row &%ignore_fromline_local%& "allow &""From ""& from local SMTP" .row &%pipelining_advertise_hosts%& "advertise pipelining to these hosts" .row &%prdr_enable%& "advertise PRDR to all hosts" +.row &%smtputf8_advertise_hosts%& "advertise SMTPUTF8 to these hosts" .row &%tls_advertise_hosts%& "advertise TLS to these hosts" .endtable @@ -14412,6 +14568,14 @@ own &'Reply-To:'& header line, the value of the &%errors_reply_to%& option is not used. +.new +.option event_action main string&!! unset +.cindex events +This option declares a string to be expanded for Exim's events mechanism. +For details see &<>&. +.wen + + .option exim_group main string "compile-time configured" .cindex "gid (group id)" "Exim's own" .cindex "Exim group" @@ -14459,7 +14623,7 @@ routing, but which are not used for listening by the daemon. See section . Allow this long option name to split; give it unsplit as a fifth argument . for the automatic .oindex that is generated by .option. -.option "extract_addresses_remove_ &~&~arguments" main boolean true &&& +.option "extract_addresses_remove_arguments" main boolean true &&& extract_addresses_remove_arguments .oindex "&%-t%&" .cindex "command line" "addresses with &%-t%&" @@ -14757,6 +14921,14 @@ If the &%smtp_connection%& log selector is not set, this option has no effect. +.new +.option hosts_proxy main "host list&!!" unset +.cindex proxy "proxy protocol" +This option enables use of Proxy Protocol proxies for incoming +connections. For details see &<>&. +.wen + + .option hosts_treat_as_local main "domain list&!!" unset .cindex "local host" "domains treated as" .cindex "host" "treated as local" @@ -14833,6 +15005,7 @@ logged. .option ldap_ca_cert_dir main string unset .cindex "LDAP", "TLS CA certificate directory" +.cindex certificate "directory for LDAP" This option indicates which directory contains CA certificates for verifying a TLS certificate presented by an LDAP server. While Exim does not provide a default value, your SSL library may. @@ -14842,6 +15015,7 @@ and constrained to be a directory. .option ldap_ca_cert_file main string unset .cindex "LDAP", "TLS CA certificate file" +.cindex certificate "file for LDAP" This option indicates which file contains CA certificates for verifying a TLS certificate presented by an LDAP server. While Exim does not provide a default value, your SSL library may. @@ -14851,6 +15025,7 @@ and constrained to be a file. .option ldap_cert_file main string unset .cindex "LDAP" "TLS client certificate file" +.cindex certificate "file for LDAP" This option indicates which file contains an TLS client certificate which Exim should present to the LDAP server during TLS negotiation. Should be used together with &%ldap_cert_key%&. @@ -14858,6 +15033,7 @@ Should be used together with &%ldap_cert_key%&. .option ldap_cert_key main string unset .cindex "LDAP" "TLS client key file" +.cindex certificate "key for LDAP" This option indicates which file contains the secret/private key to use to prove identity to the LDAP server during TLS negotiation. Should be used together with &%ldap_cert_file%&, which contains the @@ -16291,6 +16467,17 @@ example, instead of &"Administrative prohibition"&, it might give: 550 failing address in "From" header is: >& for details of Exim's support for internationalisation. +.wen + + .option spamd_address main string "see below" This option is available when Exim is compiled with the content-scanning extension. It specifies how Exim connects to SpamAssassin's &%spamd%& daemon. @@ -16534,7 +16721,9 @@ runs. This is appropriate behaviour for obtaining wall-clock time on some, but unfortunately not all, operating systems. -.option tls_advertise_hosts main "host list&!!" unset +.new +.option tls_advertise_hosts main "host list&!!" * +.wen .cindex "TLS" "advertising" .cindex "encryption" "on SMTP connection" .cindex "SMTP" "encrypted connection" @@ -16542,6 +16731,11 @@ When Exim is built with support for TLS encrypted connections, the availability of the STARTTLS command to set up an encrypted session is advertised in response to EHLO only to those client hosts that match this option. See chapter &<>& for details of Exim's support for TLS. +.new +Note that the default value requires that a certificate be supplied +using the &%tls_certificate%& option. If no certificate is available then +the &%tls_advertise_hosts%& option should be set empty. +.wen .option tls_certificate main string&!! unset @@ -16668,6 +16862,10 @@ must if set expand to the absolute path to a file which contains a current status proof for the server's certificate, as obtained from the Certificate Authority. +.new +Usable for GnuTLS 3.4.4 or 3.3.17 or OpenSSL 1.1.0 (or later). +.wen + .option tls_on_connect_ports main "string list" unset .cindex SSMTP @@ -20416,6 +20614,13 @@ its removal from incoming messages, so that delivered messages can safely be resent to other recipients. +.option event_action transports string&!! unset +.cindex events +This option declares a string to be expanded for Exim's events mechanism. +For details see &<>&. +.wen + + .option group transports string&!! "Exim group" .cindex "transport" "group; specifying" This option specifies a gid for running the transport process, overriding any @@ -20517,6 +20722,32 @@ transport, the &[initgroups()]& function is called when running the transport to ensure that any additional groups associated with the uid are set up. +.new +.option max_parallel transports integer&!! unset +.cindex limit "transport parallelism" +.cindex transport "parallel processes" +.cindex transport "concurrency limit" +.cindex "delivery" "parallelism for transport" +If this option is set and expands to an integer greater than zero +it limits the number of concurrent runs of the transport. +The control does not apply to shadow transports. + +.cindex "hints database" "transport concurrency control" +Exim implements this control by means of a hints database in which a record is +incremented whenever a transport process is beaing created. The record +is decremented and possibly removed when the process terminates. +Obviously there is scope for +records to get left lying around if there is a system or program crash. To +guard against this, Exim ignores any records that are more than six hours old. + +If you use this option, you should also arrange to delete the +relevant hints database whenever your system reboots. The names of the files +start with &_misc_& and they are kept in the &_spool/db_& directory. There +may be one or two files, depending on the type of DBM in use. The same files +are used for ETRN and smtp transport serialization. +.wen + + .option message_size_limit transports string&!! 0 .cindex "limit" "message size per transport" .cindex "size" "of message, limit" @@ -20663,6 +20894,9 @@ headers that some sites insist on. This option sets up a filtering (in the Unix shell sense) process for messages at transport time. It should not be confused with mail filtering as set up by individual users or via a system filter. +.new +If unset, or expanding to an empty string, no filtering is done. +.wen When the message is about to be written out, the command specified by &%transport_filter%& is started up in a separate, parallel process, and @@ -22414,6 +22648,10 @@ If two messages arrive at almost the same time, and both are routed to a pipe delivery, the two pipe transports may be run concurrently. You must ensure that any pipe commands you set up are robust against this happening. If the commands write to a file, the &%exim_lock%& utility might be of use. +.new +Alternatively the &%max_parallel%& option could be used with a value +of "1" to enforce serialization. +.wen @@ -22694,7 +22932,7 @@ See the &%timeout_defer%& option for how timeouts are handled. .cindex "&(pipe)& transport" "logging output" If this option is set, and the status returned by the command is one of the codes listed in &%temp_errors%& (that is, delivery was deferred), -and any output was produced on stdout or stderr, the first line of it is +and any output was produced on stdout or stderr, the first line of it is written to the main log. @@ -23596,6 +23834,10 @@ start with &_misc_& and they are kept in the &_spool/db_& directory. There may be one or two files, depending on the type of DBM in use. The same files are used for ETRN serialization. +.new +See also the &%max_parallel%& generic transport option. +.wen + .option size_addition smtp integer 1024 .cindex "SMTP" "SIZE" @@ -23614,6 +23856,14 @@ Alternatively, if the value of &%size_addition%& is set negative, it disables the use of the SIZE option altogether. +.new +.option socks_proxy smtp string&!! unset +.cindex proxy SOCKS +This option enables use of SOCKS proxies for connections made by the +transport. For details see &<>&. +.wen + + .option tls_certificate smtp string&!! unset .cindex "TLS" "client certificate, location of" .cindex "certificate" "client, location of" @@ -24247,7 +24497,7 @@ replaced, not just the working part. The replacement must be a complete RFC 2822 address, including the angle brackets if necessary. If text outside angle brackets contains a character whose value is greater than 126 or less than 32 (except for tab), the text is encoded according to RFC 2047. The character set -is taken from &%headers_charset%&, which defaults to ISO-8859-1. +is taken from &%headers_charset%&, which gets its default at build time. When the &"w"& flag is set on a rule that causes an envelope address to be rewritten, all but the working part of the replacement address is discarded. @@ -26223,6 +26473,24 @@ tls: } } } } server_set_id = ${if = {1}{${listcount:$auth1}} {$auth1}{}} .endd +This accepts a client certificate that is verifiable against any +of your configured trust-anchors +which usually means the full set of public CAs) +and which has a SAN with a good account name. +Note that the client cert is on the wire in-clear, including the SAN, +whereas a plaintext SMTP AUTH done inside TLS is not. + +. An alternative might use +. .code +. server_param1 = ${sha256:$tls_in_peercert} +. .endd +. to require one of a set of specific certs that define a given account +. (the verification is still required, but mostly irrelevant). +. This would help for per-device use. +. +. However, for the future we really need support for checking a +. user cert in LDAP - which probably wants a base-64 DER. + .ecindex IIDtlsauth1 .ecindex IIDtlsauth2 @@ -26754,7 +27022,9 @@ starts retrying to fetch an OCSP proof some time before its current proof expires. The downside is that it requires server support. Unless Exim is built with the support disabled, -or with GnuTLS earlier than version 3.1.3, +.new +or with GnuTLS earlier than version 3.3.16 / 3.4.8 +.wen support for OCSP stapling is included. There is a global option called &%tls_ocsp_file%&. @@ -27336,8 +27606,12 @@ for some or all recipients. PRDR may be used to support per-user content filtering. Without it one must defer any recipient after the first that has a different content-filter configuration. With PRDR, the RCPT-time check -for this can be disabled when the MAIL-time $smtp_command included -"PRDR". Any required difference in behaviour of the main DATA-time +.new +.cindex "PRDR" "variable for" +for this can be disabled when the variable &$prdr_requested$& +is &"yes"&. +.wen +Any required difference in behaviour of the main DATA-time ACL should however depend on the PRDR-time ACL having run, as Exim will avoid doing so in some situations (e.g. single-recipient mails). @@ -28516,6 +28790,13 @@ data is read. &*Note:*& This control applies only to the current message, not to any others that are being submitted at the same time using &%-bs%& or &%-bS%&. + +.new +.vitem &*control&~=&~utf8_downconvert*& +This control enables conversion of UTF-8 in message addresses +to a-label form. +For details see &<>&. +.wen .endlist vlist @@ -29030,7 +29311,8 @@ This condition is relevant only in an ACL that is run after a message has been received, that is, in an ACL specified by &%acl_smtp_data%& or &%acl_not_smtp%&. It checks the syntax of all header lines that can contain lists of addresses (&'Sender:'&, &'From:'&, &'Reply-To:'&, &'To:'&, &'Cc:'&, -and &'Bcc:'&). Unqualified addresses (local parts without domains) are +and &'Bcc:'&), returning true if there are no problems. +Unqualified addresses (local parts without domains) are permitted only in locally generated messages and from hosts that match &%sender_unqualified_hosts%& or &%recipient_unqualified_hosts%&, as appropriate. @@ -29192,9 +29474,15 @@ deny dnslists = blackholes.mail-abuse.org warn message = X-Warn: sending host is on dialups list dnslists = dialups.mail-abuse.org .endd -DNS list lookups are cached by Exim for the duration of the SMTP session, +.cindex cacheing "of dns lookup" +.cindex DNS TTL +DNS list lookups are cached by Exim for the duration of the SMTP session +.new +(but limited by the DNS return TTL value), +.wen so a lookup based on the IP address is done at most once for any incoming -connection. Exim does not share information between multiple incoming +connection (assuming long-enough TTL). +Exim does not share information between multiple incoming connections (but your local name server cache should be active). @@ -30947,6 +31235,10 @@ malware = * / defer_ok / tmo=10s .endd A timeout causes the ACL to defer. +.vindex "&$callout_address$&" +When a connection is made to the scanner the expansion variable &$callout_address$& +is set to record the actual address used. + .vindex "&$malware_name$&" When a virus is found, the condition sets up an expansion variable called &$malware_name$& that contains the name of the virus. You can use it in a @@ -31058,7 +31350,7 @@ In the latter case, the range is tried in strict order. Elements after the first for Unix sockets, or second for TCP socket, are options. -The supported option are: +The supported options are: .code pri= Selection priority weight= Selection bias @@ -31097,6 +31389,10 @@ a dollar sign. In this case, the expansion may return a string that is used as the list so that multiple spamd servers can be the result of an expansion. +.vindex "&$callout_address$&" +When a connection is made to the server the expansion variable &$callout_address$& +is set to record the actual address used. + .section "Calling SpamAssassin from an Exim ACL" "SECID206" Here is a simple example of the use of the &%spam%& condition in a DATA ACL: .code @@ -31455,6 +31751,8 @@ deny message = contains blacklisted regex ($regex_match_string) The conditions returns true if any one of the regular expressions matches. The &$regex_match_string$& expansion variable is then set up and contains the matching regular expression. +The expansion variables &$regex1$& &$regex2$& etc +are set to any substrings captured by the regular expression. &*Warning*&: With large messages, these conditions can be fairly CPU-intensive. @@ -35049,6 +35347,7 @@ extensions (ESMTP), encryption, or authentication were used. If the SMTP session was encrypted, there is an additional X field that records the cipher suite that was used. +.cindex log protocol The protocol is set to &"esmtpsa"& or &"esmtpa"& for messages received from hosts that have authenticated themselves using the SMTP AUTH command. The first value is used when the SMTP connection was encrypted (&"secure"&). In this case @@ -35073,7 +35372,7 @@ data when a message is received. See section &<>& below. .cindex "log" "delivery line" The format of the single-line entry in the main log that is written for every delivery is shown in one of the examples below, for local and remote -deliveries, respectively. Each example has been split into two lines in order +deliveries, respectively. Each example has been split into multiple lines in order to fit it on the page: .code 2002-10-31 08:59:13 16ZCW1-0005MB-00 => marv @@ -35219,6 +35518,7 @@ the following table: &`id `& message id for incoming message &`P `& on &`<=`& lines: protocol used &` `& on &`=>`& and &`**`& lines: return path +&`PRX `& on &'<='& and&`=>`& lines: proxy address &`QT `& on &`=>`& lines: time spent on queue so far &` `& on &"Completed"& lines: time spent on queue &`R `& on &`<=`& lines: reference for local bounce @@ -35307,11 +35607,17 @@ selection marked by asterisks: &` incoming_interface `& local interface on <= and => lines &` incoming_port `& remote port on <= lines &`*lost_incoming_connection `& as it says (includes timeouts) +.new +&` outgoing_interface `& local interface on => lines +.wen &` outgoing_port `& add remote port to => lines &`*queue_run `& start and end queue runs &` queue_time `& time on queue for one recipient &` queue_time_overall `& time on queue for whole message &` pid `& Exim process id +.new +&` proxy `& proxy address on <= and => lines +.wen &` received_recipients `& recipients on <= lines &` received_sender `& sender on <= lines &`*rejected_header `& header contents on reject log @@ -35432,9 +35738,22 @@ client's ident port times out. &%incoming_interface%&: The interface on which a message was received is added to the &"<="& line as an IP address in square brackets, tagged by I= and followed by a colon and the port number. The local interface and port are also -added to other SMTP log lines, for example &"SMTP connection from"& and to -rejection lines -and (despite the name) the local interface is added to &"=>"& lines.. +added to other SMTP log lines, for example &"SMTP connection from"&, to +rejection lines, and (despite the name) to outgoing &"=>"& and &"->"& lines. +.new +The latter can be disabled by turning off the &%outgoing_interface%& option. +.wen +.next +.new +.cindex log "incoming proxy address" +.cindex proxy "logging proxy address" +.cindex "TCP/IP" "logging proxy address" +&%proxy%&: The internal (closest to the system running Exim) IP address +of the proxy, tagged by PRX=, on the &"<="& line for a message accepted +on a proxied connection +or the &"=>"& line for a message delivered on a proxied connection.. +See &<>& for more information. +.wen .next .cindex "log" "incoming remote port" .cindex "port" "logging remote" @@ -35452,13 +35771,30 @@ important with the widening use of NAT (see RFC 2505). &%lost_incoming_connection%&: A log line is written when an incoming SMTP connection is unexpectedly dropped. .next +.cindex "log" "outgoing interface" +.cindex "log" "local interface" +.cindex "log" "local address and port" +.cindex "TCP/IP" "logging local address and port" +.cindex "interface" "logging" +.new +&%outgoing_interface%&: If &%incoming_interface%& is turned on, then the +interface on which a message was sent is added to delivery lines as an I= tag +followed by IP address in square brackets. You can disable this by turning +off the &%outgoing_interface%& option. +.wen +.next .cindex "log" "outgoing remote port" .cindex "port" "logging outgoint remote" .cindex "TCP/IP" "logging ougtoing remote port" &%outgoing_port%&: The remote port number is added to delivery log lines (those -containing => tags) following the IP address. This option is not included in -the default setting, because for most ordinary configurations, the remote port -number is always 25 (the SMTP port). +containing => tags) following the IP address. +.new +The local port is also added if &%incoming_interface%& and +&%outgoing_interface%& are both enabled. +.wen +This option is not included in the default setting, because for most ordinary +configurations, the remote port number is always 25 (the SMTP port), and the +local port is a random ephemeral port. .next .cindex "log" "process ids in" .cindex "pid (process id)" "in log lines" @@ -36202,6 +36538,9 @@ Serializing ETRN runs (when &%smtp_etrn_serialize%& is set) .next Serializing delivery to a specific host (when &%serialize_hosts%& is set in an &(smtp)& transport) +.next +Limiting the concurrency of specific transports (when &%max_parallel%& is set +in a transport) .endlist @@ -37578,7 +37917,7 @@ be tracked on a per-domain basis, rather than merely upon source IP address. DKIM is documented in RFC 4871. Since version 4.70, DKIM support is compiled into Exim by default. It can be -disabled by setting DISABLE_DKIM=yes in Local/Makefile. +disabled by setting DISABLE_DKIM=yes in &_Local/Makefile_&. Exim's DKIM implementation allows to .olist @@ -37804,6 +38143,8 @@ Key granularity (tag g=) from the key record. Defaults to "*" if not specified in the key record. .vitem &%$dkim_key_notes%& Notes from the key record (tag n=). +.vitem &%$dkim_key_length%& +Number of bits in the key. .endlist In addition, two ACL conditions are provided: @@ -37843,6 +38184,390 @@ for more information of what they mean. . //////////////////////////////////////////////////////////////////////////// . //////////////////////////////////////////////////////////////////////////// +.chapter "Proxies" "CHAPproxies" &&& + "Proxy support" +.cindex "proxy support" +.cindex "proxy" "access via" + +.new +A proxy is an intermediate system through which communication is passed. +Proxies may provide a security, availability or load-distribution function. + + +.section "Inbound proxies" SECTproxyInbound +.cindex proxy inbound +.cindex proxy "server side" +.cindex proxy "Proxy protocol" +.cindex "Proxy protocol" proxy + +Exim has support for receiving inbound SMTP connections via a proxy +that uses &"Proxy Protocol"& to speak to it. +To include this support, include &"SUPPORT_PROXY=yes"& +in Local/Makefile. + +It was built on specifications from: +http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt +That URL was revised in May 2014 to version 2 spec: +http://git.1wt.eu/web?p=haproxy.git;a=commitdiff;h=afb768340c9d7e50d8e + +The purpose of this facility is so that an application load balancer, +such as HAProxy, can sit in front of several Exim servers +to distribute load. +Exim uses the local protocol communication with the proxy to obtain +the remote SMTP system IP address and port information. +There is no logging if a host passes or +fails Proxy Protocol negotiation, but it can easily be determined and +recorded in an ACL (example is below). + +Use of a proxy is enabled by setting the &%hosts_proxy%& +main configuration option to a hostlist; connections from these +hosts will use Proxy Protocol. + +The following expansion variables are usable +(&"internal"& and &"external"& here refer to the interfaces +of the proxy): +.display +&'proxy_host_address '& internal IP address of the proxy +&'proxy_host_port '& internal TCP port of the proxy +&'proxy_target_address '& external IP address of the proxy +&'proxy_target_port '& external TCP port of the proxy +&'proxy_session '& boolean: SMTP connection via proxy +.endd +If &$proxy_session$& is set but &$proxy_host_address$& is empty +there was a protocol error. + +Since the real connections are all coming from the proxy, and the +per host connection tracking is done before Proxy Protocol is +evaluated, &%smtp_accept_max_per_host%& must be set high enough to +handle all of the parallel volume you expect per inbound proxy. +With the option set so high, you lose the ability +to protect your server from many connections from one IP. +In order to prevent your server from overload, you +need to add a per connection ratelimit to your connect ACL. +A possible solution is: +.display + # Set max number of connections per host + LIMIT = 5 + # Or do some kind of IP lookup in a flat file or database + # LIMIT = ${lookup{$sender_host_address}iplsearch{/etc/exim/proxy_limits}} + + defer message = Too many connections from this IP right now + ratelimit = LIMIT / 5s / per_conn / strict +.endd + + + +.section "Outbound proxies" SECTproxySOCKS +.cindex proxy outbound +.cindex proxy "client side" +.cindex proxy SOCKS +.cindex SOCKS proxy +Exim has support for sending outbound SMTP via a proxy +using a protocol called SOCKS5 (defined by RFC1928). +The support can be optionally included by defining SUPPORT_SOCKS=yes in +Local/Makefile. + +Use of a proxy is enabled by setting the &%socks_proxy%& option +on an smtp transport. +The option value is expanded and should then be a list +(colon-separated by default) of proxy specifiers. +Each proxy specifier is a list +(space-separated by default) where the initial element +is an IP address and any subsequent elements are options. + +Options are a string =. +The list of options is in the following table: +.display +&'auth '& authentication method +&'name '& authentication username +&'pass '& authentication password +&'port '& tcp port +&'tmo '& connection timeout +&'pri '& priority +&'weight '& selection bias +.endd + +More details on each of these options follows: + +.ilist +.cindex authentication "to proxy" +.cindex proxy authentication +&%auth%&: Either &"none"& (default) or &"name"&. +Using &"name"& selects username/password authentication per RFC 1929 +for access to the proxy. +Default is &"none"&. +.next +&%name%&: sets the username for the &"name"& authentication method. +Default is empty. +.next +&%pass%&: sets the password for the &"name"& authentication method. +Default is empty. +.next +&%port%&: the TCP port number to use for the connection to the proxy. +Default is 1080. +.next +&%tmo%&: sets a connection timeout in seconds for this proxy. +Default is 5. +.next +&%pri%&: specifies a priority for the proxy within the list, +higher values being tried first. +The default priority is 1. +.next +&%weight%&: specifies a selection bias. +Within a priority set servers are queried in a random fashion, +weighted by this value. +The default value for selection bias is 1. +.endlist + +Proxies from the list are tried according to their priority +and weight settings until one responds. The timeout for the +overall connection applies to the set of proxied attempts. + +.section Logging SECTproxyLog +To log the (local) IP of a proxy in the incoming or delivery logline, +add &"+proxy"& to the &%log_selector%& option. +This will add a component tagged with &"PRX="& to the line. +.wen + +. //////////////////////////////////////////////////////////////////////////// +. //////////////////////////////////////////////////////////////////////////// + +.chapter "Internationalisation" "CHAPi18n" &&& + "Internationalisation"" +.cindex internationalisation "email address" +.cindex EAI +.cindex i18n +.cindex UTF-8 "mail name handling" + +.new +Exim has support for Internationalised mail names. +To include this it must be built with SUPPORT_I18N and the libidn library. +Standards supported are RFCs 2060, 5890, 6530 and 6533. + +.section "MTA operations" SECTi18nMTA +.cindex SMTPUTF8 "ESMTP option" +The main configuration option &%smtputf8_advertise_hosts%& specifies +a host list. If this matches the sending host and +accept_8bitmime is true (the default) then the ESMTP option +SMTPUTF8 will be advertised. + +If the sender specifies the SMTPUTF8 option on a MAIL command +international handling for the message is enabled and +the expansion variable &$message_smtputf8$& will have value TRUE. + +The option &%allow_utf8_domains%& is set to true for this +message. All DNS lookups are converted to a-label form +whatever the setting of &%allow_utf8_domains%& +when Exim is built with SUPPORT_I18N. + +Both localparts and domain are maintained as the original +UTF-8 form internally; any comparison or regular-expression use will +require appropriate care. Filenames created, eg. by +the appendfile transport, will have UTF-8 names. + +HELO names sent by the smtp transport will have any UTF-8 +components expanded to a-label form, +and any certificate name checks will be done using the a-label +form of the name. + +.cindex log protocol +.cindex SMTPUTF8 logging +Log lines and Received-by: header lines will acquire a "utf8" +prefix on the protocol element, eg. utf8esmtp. + +The following expansion operator can be used: +.code +${utf8_domain_to_alabel:str} +${utf8_domain_from_alabel:str} +${utf8_localpart_to_alabel:str} +${utf8_localpart_from_alabel:str} +.endd + +ACLs may use the following modifier: +.display +control = utf8_downconvert +control = utf8_downconvert/ +.endd +This sets a flag requiring that addresses are converted to +a-label form before smtp delivery, for use in a +Message Submission Agent context. +If a value is appended it may be: +.display +&`1 `& (default) mandatory downconversion +&`0 `& no downconversion +&`-1 `& if SMTPUTF8 not supported by destination host +.endd + +If mua_wrapper is set, the utf8_downconvert control +is initially set to -1. + + +There is no explicit support for VRFY and EXPN. +Configurations supporting these should inspect +&$smtp_command_argument$& for an SMTPUTF8 argument. + +There is no support for LMTP on Unix sockets. +Using the "lmtp" protocol option on an smtp transport, +for LMTP over TCP, should work as expected. + +There is no support for DSN unitext handling, +and no provision for converting logging from or to UTF-8. + + + +.section "MDA operations" SECTi18nMDA +To aid in constructing names suitable for IMAP folders +the following expansion operator can be used: +.code +${imapfolder {} {} {}} +.endd + +The string is converted from the charset specified by +the "headers charset" command (in a filter file) +or &%headers_charset%& main configuration option (otherwise), +to the +modified UTF-7 encoding specified by RFC 2060, +with the following exception: All occurences of +(which has to be a single character) +are replaced with periods ("."), and all periods and slashes that are not + and are not in the string are BASE64 encoded. + +The third argument can be omitted, defaulting to an empty string. +The second argument can be omitted, defaulting to "/". + +This is the encoding used by Courier for Maildir names on disk, and followed +by many other IMAP servers. + +Examples: +.display +&`${imapfolder {Foo/Bar}} `& yields &`Foo.Bar`& +&`${imapfolder {Foo/Bar}{.}{/}} `& yields &`Foo&&AC8-Bar`& +&`${imapfolder {Räksmörgås}} `& yields &`R&&AOQ-ksm&&APY-rg&&AOU-s`& +.endd + +Note that the source charset setting is vital, and also that characters +must be representable in UTF-16. + +.wen + +. //////////////////////////////////////////////////////////////////////////// +. //////////////////////////////////////////////////////////////////////////// + +.chapter "Events" "CHAPevents" &&& + "Events" +.cindex events + +.new +The events mechanism in Exim can be used to intercept processing at a number +of points. It was originally invented to giave a way to do customised logging +actions (for example, to a database) but can also be used to modify some +processing actions. + +Most installations will never need to use Events. +The support can be left out of a build by defining DISABLE_EVENT=yes +in &_Local/Makefile_&. + +There are two major classes of events: main and transport. +The main configuration option &%event_action%& controls reception events; +a transport option &%event_action%& controls delivery events. + +Both options are a string which is expanded when the event fires. +An example might look like: +.cindex logging custom +.code +event_action = ${if eq {msg:delivery}{$event_name} \ +{${lookup pgsql {SELECT * FROM record_Delivery( \ + '${quote_pgsql:$sender_address_domain}',\ + '${quote_pgsql:${lc:$sender_address_local_part}}', \ + '${quote_pgsql:$domain}', \ + '${quote_pgsql:${lc:$local_part}}', \ + '${quote_pgsql:$host_address}', \ + '${quote_pgsql:${lc:$host}}', \ + '${quote_pgsql:$message_exim_id}')}} \ +} {}} +.endd + +Events have names which correspond to the point in process at which they fire. +The name is placed in the variable &$event_name$& and the event action +expansion must check this, as it will be called for every possible event type. + +The current list of events is: +.display +&`msg:complete after main `& per message +&`msg:delivery after transport `& per recipient +&`msg:rcpt:host:defer after transport `& per recipient per host +&`msg:rcpt:defer after transport `& per recipient +&`msg:host:defer after transport `& per attempt +&`msg:fail:delivery after main `& per recipient +&`msg:fail:internal after main `& per recipient +&`tcp:connect before transport `& per connection +&`tcp:close after transport `& per connection +&`tls:cert before both `& per certificate in verification chain +&`smtp:connect after transport `& per connection +.endd +New event types may be added in future. + +The event name is a colon-separated list, defining the type of +event in a tree of possibilities. It may be used as a list +or just matched on as a whole. There will be no spaces in the name. + +The second column in the table above describes whether the event fires +before or after the action is associates with. Those which fire before +can be used to affect that action (more on this below). + +An additional variable, &$event_data$&, is filled with information varying +with the event type: +.display +&`msg:delivery `& smtp confirmation mssage +&`msg:rcpt:host:defer `& error string +&`msg:rcpt:defer `& error string +&`msg:host:defer `& error string +&`tls:cert `& verification chain depth +&`smtp:connect `& smtp banner +.endd + +The :defer events populate one extra variable: &$event_defer_errno$&. + +For complex operations an ACL expansion can be used in &%event_action%& +however due to the multiple contextx that Exim operates in during +the course of its processing: +.ilist +variables set in transport events will not be visible outside that +transport call +.next +acl_m variables in a server context are lost on a new connection, +and after smtp helo/ehlo/mail/starttls/rset commands +.endlist +Using an ACL expansion with the logwrite modifier can be +a useful way of writing to the main log. + +The expansion of the event_action option should normally +return an empty string. Should it return anything else the +following will be forced: +.display +&`msg:delivery `& (ignored) +&`msg:host:defer `& (ignored) +&`msg:fail:delivery`& (ignored) +&`tcp:connect `& do not connect +&`tcp:close `& (ignored) +&`tls:cert `& refuse verification +&`smtp:connect `& close connection +.endd +No other use is made of the result string. + +For a tcp:connect event, if the connection is being made to a proxy +then the address and port variables will be that of the proxy and not +the target system. + +For tls:cert events, if GnuTLS is in use this will trigger only per +chain element received on the connection. +For OpenSSL it will trigger for every chain element including those +loaded locally. +.wen + +. //////////////////////////////////////////////////////////////////////////// +. //////////////////////////////////////////////////////////////////////////// + .chapter "Adding new drivers or lookup types" "CHID13" &&& "Adding drivers or lookups" .cindex "adding drivers"