X-Git-Url: https://git.exim.org/users/heiko/exim.git/blobdiff_plain/e89d95f1909c0972b0e854ae05f50246f4d727d6..f5ee670dc5eb90c68ee684f478598bd9af6fbf36:/doc/doc-docbook/spec.xfpt diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index 8350b4da7..9a49373f3 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -8744,8 +8744,13 @@ The value for a match will be the list element string. .cindex "tainted data" "de-tainting" Note that this is commonly untainted (depending on the way the list was created). +Specifically, explicit text in the configuration file in not tainted. This is a useful way of obtaining an untainted equivalent to the domain, for later operations. + +However if the list (including one-element lists) +is created by expanding a variable containing tainted data, +it is tainted and so will the match value be. .endlist @@ -12472,25 +12477,32 @@ the complete argument of the ETRN command (see section &<>&). .cindex "tainted data" If the origin of the data is an incoming message, -the result of expanding this variable is tainted. -When in untainted version is needed, one should be obtained from +the result of expanding this variable is tainted and may not +be further expanded or used as a filename. +When an untainted version is needed, one should be obtained from looking up the value in a local (therefore trusted) database. Often &$domain_data$& is usable in this role. .vitem &$domain_data$& .vindex "&$domain_data$&" -When the &%domains%& option on a router matches a domain by -means of a lookup, the data read by the lookup is available during the running -of the router as &$domain_data$&. In addition, if the driver routes the +When the &%domains%& condition on a router +.new +or an ACL +matches a domain +against a list, the match value is copied to &$domain_data$&. +This is an enhancement over previous versions of Exim, when it only +applied to the data read by a lookup. +For details on match values see section &<>& et. al. +.wen + +If the router routes the address to a transport, the value is available in that transport. If the transport is handling multiple addresses, the value from the first address is used. -&$domain_data$& is also set when the &%domains%& condition in an ACL matches a -domain by means of a lookup. The data read by the lookup is available during -the rest of the ACL statement. In all other situations, this variable expands -to nothing. +&$domain_data$& set in an ACL is available during +the rest of the ACL statement. .vitem &$exim_gid$& .vindex "&$exim_gid$&" @@ -12672,7 +12684,8 @@ once. .cindex "tainted data" If the origin of the data is an incoming message, -the result of expanding this variable is tainted. +the result of expanding this variable is tainted and +may not be further expanded or used as a filename. &*Warning*&: the content of this variable is usually provided by a potential attacker. @@ -12722,19 +12735,17 @@ to process local parts in a case-dependent manner in a router, you can set the .vitem &$local_part_data$& .vindex "&$local_part_data$&" -When the &%local_parts%& option on a router matches a local part by means of a -lookup, the data read by the lookup is available during the running of the -router as &$local_part_data$&. In addition, if the driver routes the address -to a transport, the value is available in that transport. If the transport is -handling multiple addresses, the value from the first address is used. +When the &%local_parts%& condition on a router or ACL +matches a local part list +.new +the match value is copied to &$local_part_data$&. +This is an enhancement over previous versions of Exim, when it only +applied to the data read by a lookup. +For details on match values see section &<>& et. al. +.wen The &%check_local_user%& router option also sets this variable. -&$local_part_data$& is also set when the &%local_parts%& condition in an ACL -matches a local part by means of a lookup. The data read by the lookup is -available during the rest of the ACL statement. In all other situations, this -variable expands to nothing. - .vindex &$local_part_prefix$& &&& &$local_part_prefix_v$& &&& &$local_part_suffix$& &&& @@ -13808,6 +13819,8 @@ Observability for TLS session resumption. See &<>& for details. .vindex "&$tls_in_sni$&" .vindex "&$tls_sni$&" .cindex "TLS" "Server Name Indication" +.cindex "TLS" SNI +.cindex SNI "observability on server" When a TLS session is being established, if the client sends the Server Name Indication extension, the value will be placed in this variable. If the variable appears in &%tls_certificate%& then this option and @@ -13823,6 +13836,8 @@ the outbound. .vitem &$tls_out_sni$& .vindex "&$tls_out_sni$&" .cindex "TLS" "Server Name Indication" +.cindex "TLS" SNI +.cindex SNI "observability in client" During outbound SMTP deliveries, this variable reflects the value of the &%tls_sni%& option on the transport. @@ -17990,6 +18005,7 @@ syslog. The value must be no longer than 32 characters. See chapter .option syslog_timestamp main boolean true .cindex "syslog" "timestamps" +.cindex timestamps syslog If &%syslog_timestamp%& is set false, the timestamps on Exim's log lines are omitted when these lines are sent to syslog. See chapter &<>& for details of Exim's logging. @@ -18145,6 +18161,7 @@ when a list of more than one file is used, the &$tls_in_ourcert$& variable is unreliable. The macro "_TLS_BAD_MULTICERT_IN_OURCERT" will be defined for those versions. +.cindex SNI "selecting server certificate based on" If the option contains &$tls_out_sni$& and Exim is built against OpenSSL, then if the OpenSSL build supports TLS extensions and the TLS client sends the Server Name Indication extension, then this option and others documented in @@ -25697,6 +25714,8 @@ See &<>& for details. .option tls_sni smtp string&!! unset .cindex "TLS" "Server Name Indication" +.cindex "TLS" SNI +.cindex SNI "setting in client" .vindex "&$tls_sni$&" If this option is set then it sets the $tls_out_sni variable and causes any TLS session to pass this value as the Server Name Indication extension to @@ -29299,6 +29318,8 @@ outgoing connection. .section "Use of TLS Server Name Indication" "SECTtlssni" .cindex "TLS" "Server Name Indication" +.cindex "TLS" SNI +.cindex SNI .vindex "&$tls_in_sni$&" .oindex "&%tls_in_sni%&" With TLS1.0 or above, there is an extension mechanism by which extra @@ -35464,14 +35485,14 @@ address if its delivery failed. .section "Per-address filtering" "SECTperaddfil" -.vindex "&$domain$&" -.vindex "&$local_part$&" +.vindex "&$domain_data$&" +.vindex "&$local_part_data$&" In contrast to the system filter, which is run just once per message for each delivery attempt, it is also possible to set up a system-wide filtering operation that runs once for each recipient address. In this case, variables -such as &$local_part$& and &$domain$& can be used, and indeed, the choice of -filter file could be made dependent on them. This is an example of a router -which implements such a filter: +such as &$local_part_data$& and &$domain_data$& can be used, +and indeed, the choice of filter file could be made dependent on them. +This is an example of a router which implements such a filter: .code central_filter: check_local_user @@ -37292,7 +37313,7 @@ follows: .code my_mailboxes: driver = appendfile - file = /var/mail/$domain/$local_part_data + file = /var/mail/$domain_data/$local_part_data user = mail .endd This uses a directory of mailboxes for each domain. The &%user%& setting is @@ -37332,7 +37353,7 @@ It runs a user's &_.forward_& file for all local parts of the form cases by testing the variable &$local_part_suffix$&. For example: .code if $local_part_suffix contains -special then -save /home/$local_part/Mail/special +save /home/$local_part_data/Mail/special endif .endd If the filter file does not exist, or does not deal with such addresses, they @@ -38678,6 +38699,7 @@ an asterisk is appended to the X= cipher field in the log line. .next .cindex "log" "TLS SNI" .cindex "TLS" "logging SNI" +.cindex SNI logging &%tls_sni%&: When a message is received over an encrypted connection, and the remote host provided the Server Name Indication extension, the SNI is added to the log line, preceded by SNI=.