For DH, use standard primes from RFCs

[users/jgh/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index b650fc39fa6d47d22f013fb99d0cde49802c05c1..beb0522be5542f2490d063c7f32101f87f3c8cce 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -2991,6 +2991,26 @@ The specified sender is treated as if it were given as the argument to the
 preference to the address taken from the message. The caller of Exim must be a
 trusted user for the sender of a message to be set in this way.
 
 preference to the address taken from the message. The caller of Exim must be a
 trusted user for the sender of a message to be set in this way.
 

+.vitem &%-bmalware%&&~<&'filename'&>
+.oindex "&%-bmalware%&"
+.cindex "testing", "malware"
+.cindex "malware scan test"
+This debugging option causes Exim to scan the given file,
+using the malware scanning framework.  The option of &%av_scanner%& influences
+this option, so if &%av_scanner%&'s value is dependent upon an expansion then
+the expansion should have defaults which apply to this invocation.  ACLs are
+not invoked, so if &%av_scanner%& references an ACL variable then that variable
+will never be populated and &%-bmalware%& will fail.
+
+Exim will have changed working directory before resolving the filename, so
+using fully qualified pathnames is advisable.  Exim will be running as the Exim
+user when it tries to open the file, rather than as the invoking user.
+This option requires admin privileges.
+
+The &%-bmalware%& option will not be extended to be more generally useful,
+there are better tools for file-scanning.  This option exists to help
+administrators verify their Exim and AV scanner configuration.
+

 .vitem &%-bnq%&
 .oindex "&%-bnq%&"
 .cindex "address qualification, suppressing"
 .vitem &%-bnq%&
 .oindex "&%-bnq%&"
 .cindex "address qualification, suppressing"


@@ -3251,26 +3271,6 @@ above concerning senders and qualification do not apply. In this situation,
 Exim behaves in exactly the same way as it does when receiving a message via
 the listening daemon.
 
 Exim behaves in exactly the same way as it does when receiving a message via
 the listening daemon.
 

-.vitem &%-bmalware%&&~<&'filename'&>
-.oindex "&%-bmalware%&"
-.cindex "testing", "malware"
-.cindex "malware scan test"
-This debugging option causes Exim to scan the given file,
-using the malware scanning framework.  The option of &%av_scanner%& influences
-this option, so if &%av_scanner%&'s value is dependent upon an expansion then
-the expansion should have defaults which apply to this invocation.  ACLs are
-not invoked, so if &%av_scanner%& references an ACL variable then that variable
-will never be populated and &%-bmalware%& will fail.
-
-Exim will have changed working directory before resolving the filename, so
-using fully qualified pathnames is advisable.  Exim will be running as the Exim
-user when it tries to open the file, rather than as the invoking user.
-This option requires admin privileges.
-
-The &%-bmalware%& option will not be extended to be more generally useful,
-there are better tools for file-scanning.  This option exists to help
-administrators verify their Exim and AV scanner configuration.
-

 .vitem &%-bt%&
 .oindex "&%-bt%&"
 .cindex "testing" "addresses"
 .vitem &%-bt%&
 .oindex "&%-bt%&"
 .cindex "testing" "addresses"


@@ -6026,16 +6026,16 @@ that it implements the details of the specific authentication mechanism,
 i.e. PLAIN or LOGIN. The &%server_advertise_condition%& setting controls
 when Exim offers authentication to clients; in the examples, this is only
 when TLS or SSL has been started, so to enable the authenticators you also
 i.e. PLAIN or LOGIN. The &%server_advertise_condition%& setting controls
 when Exim offers authentication to clients; in the examples, this is only
 when TLS or SSL has been started, so to enable the authenticators you also

-need to add support for TLS as described in &<<SECTdefconfmain>>&.
+need to add support for TLS as described in section &<<SECTdefconfmain>>&.

 
 The &%server_condition%& setting defines how to verify that the username and
 password are correct. In the examples it just produces an error message.
 To make the authenticators work, you can use a string expansion
 
 The &%server_condition%& setting defines how to verify that the username and
 password are correct. In the examples it just produces an error message.
 To make the authenticators work, you can use a string expansion

-expression like one of the examples in &<<CHAPplaintext>>&.
+expression like one of the examples in chapter &<<CHAPplaintext>>&.

 
 Beware that the sequence of the parameters to PLAIN and LOGIN differ; the
 
 Beware that the sequence of the parameters to PLAIN and LOGIN differ; the

-usercode and password are in different positions.  &<<CHAPplaintext>>&
-covers both.
+usercode and password are in different positions.
+Chapter &<<CHAPplaintext>>& covers both.

 
 .ecindex IIDconfiwal
 
 
 .ecindex IIDconfiwal
 


@@ -6790,14 +6790,16 @@ white space is ignored.
 .cindex "TXT record" "in &(dnsdb)& lookup"
 .cindex "SPF record" "in &(dnsdb)& lookup"
 .new
 .cindex "TXT record" "in &(dnsdb)& lookup"
 .cindex "SPF record" "in &(dnsdb)& lookup"
 .new

-For TXT and SPF records with multiple items of data, only the first item is returned,
+For TXT records with multiple items of data, only the first item is returned,

 unless a separator for them is specified using a comma after the separator
 unless a separator for them is specified using a comma after the separator

-character followed immediately by the TXT/SPF record item separator. To concatenate
-items without a separator, use a semicolon instead.
+character followed immediately by the TXT record item separator. To concatenate
+items without a separator, use a semicolon instead. For SPF records the
+default behaviour is to concatenate multiple items without using a separator.

 .wen
 .code
 ${lookup dnsdb{>\n,: txt=a.b.example}}
 ${lookup dnsdb{>\n; txt=a.b.example}}
 .wen
 .code
 ${lookup dnsdb{>\n,: txt=a.b.example}}
 ${lookup dnsdb{>\n; txt=a.b.example}}

+${lookup dnsdb{spf=example.org}}

 .endd
 It is permitted to specify a space as the separator character. Further
 white space is ignored.
 .endd
 It is permitted to specify a space as the separator character. Further
 white space is ignored.


@@ -12692,6 +12694,7 @@ listed in more than one group.
 .row &%tls_advertise_hosts%&         "advertise TLS to these hosts"
 .row &%tls_certificate%&             "location of server certificate"
 .row &%tls_crl%&                     "certificate revocation list"
 .row &%tls_advertise_hosts%&         "advertise TLS to these hosts"
 .row &%tls_certificate%&             "location of server certificate"
 .row &%tls_crl%&                     "certificate revocation list"

+.row &%tls_dh_max_bits%&             "clamp D-H bit count suggestion"

 .row &%tls_dhparam%&                 "DH parameters for server"
 .row &%tls_on_connect_ports%&        "specify SSMTP (SMTPS) ports"
 .row &%tls_privatekey%&              "location of server private key"
 .row &%tls_dhparam%&                 "DH parameters for server"
 .row &%tls_on_connect_ports%&        "specify SSMTP (SMTPS) ports"
 .row &%tls_privatekey%&              "location of server private key"


@@ -15678,12 +15681,69 @@ See &<<SECTtlssni>>& for discussion of when this option might be re-expanded.
 .wen
 
 
 .wen
 
 

+.new
+.option tls_dh_max_bits main integer 2236
+.cindex "TLS" "D-H bit count"
+The number of bits used for Diffie-Hellman key-exchange may be suggested by
+the chosen TLS library.  That value might prove to be too high for
+interoperability.  This option provides a maximum clamp on the value
+suggested, trading off security for interoperability.
+
+The value must be at least 1024.
+
+The value 2236 was chosen because, at time of adding the option, it was the
+hard-coded maximum value supported by the NSS cryptographic library, as used
+by Thunderbird, while GnuTLS was suggesting 2432 bits as normal.
+
+If you prefer more security and are willing to break some clients, raise this
+number.
+
+Note that the value passed to GnuTLS for *generating* a new prime may be a
+little less than this figure, because GnuTLS is inexact and may produce a
+larger prime than requested.
+.wen
+
+

 .option tls_dhparam main string&!! unset
 .cindex "TLS" "D-H parameters for server"
 .option tls_dhparam main string&!! unset
 .cindex "TLS" "D-H parameters for server"

-The value of this option is expanded, and must then be the absolute path to
-a file which contains the server's DH parameter values.
-This is used only for OpenSSL. When Exim is linked with GnuTLS, this option is
-ignored. See section &<<SECTopenvsgnu>>& for further details.
+.new
+The value of this option is expanded and indicates the source of DH parameters
+to be used by Exim.
+
+If it is a filename starting with a &`/`&, then it names a file from which DH
+parameters should be loaded.  If the file exists, it should hold a PEM-encoded
+PKCS#3 representation of the DH prime.  If the file does not exist, for
+OpenSSL it is an error.  For GnuTLS, Exim will attempt to create the file and
+fill it with a generated DH prime.  For OpenSSL, if the DH bit-count from
+loading the file is greater than &%tls_dh_max_bits$& then it will be ignored,
+and treated as though the &%tls_dhparam%& were set to "none".
+
+If this option expands to the string "none", then no DH parameters will be
+loaded by Exim.
+
+If this option expands to the string "historic" and Exim is using GnuTLS, then
+Exim will attempt to load a file from inside the spool directory.  If the file
+does not exist, Exim will attempt to create it.
+See section &<<SECTgnutlsparam>>& for further details.
+
+If Exim is using OpenSSL and this option is empty or unset, then Exim will load
+a default DH prime; the default is the 2048 bit prime described in section
+2.2 of RFC 5114, "2048-bit MODP Group with 224-bit Prime Order Subgroup", which
+in IKE is assigned number 23.
+
+Otherwise, the option must expand to the name used by Exim for any of a number
+of DH primes specified in RFC 2409, RFC 3526 and RFC 5114.  As names, Exim uses
+"ike" followed by the number used by IKE, of "default" which corresponds to
+"ike23".
+
+The available primes are:
+&`ike1`&, &`ike2`&, &`ike5`&,
+&`ike14`&, &`ike15`&, &`ike16`&, &`ike17`&, &`ike18`&,
+&`ike22`&, &`ike23`& (aka &`default`&) and &`ike24`&.
+
+Some of these will be too small to be accepted by clients.
+Some may be too large to be accepted by clients.
+.wen

 
 
 .option tls_on_connect_ports main "string list" unset
 
 
 .option tls_on_connect_ports main "string list" unset


@@ -17076,6 +17136,40 @@ look for A or AAAA records, unless the domain matches &%mx_domains%&, in which
 case routing fails.
 
 
 case routing fails.
 
 

+.new
+.section "Declining addresses by dnslookup" "SECTdnslookupdecline"
+.cindex "&(dnslookup)& router" "declines"
+There are a few cases where a &(dnslookup)& router will decline to accept
+an address; if such a router is expected to handle "all remaining non-local
+domains", then it is important to set &%no_more%&.
+
+Reasons for a &(dnslookup)& router to decline currently include:
+.ilist
+The domain does not exist in DNS
+.next
+The domain exists but the MX record's host part is just "."; this is a common
+convention (borrowed from SRV) used to indicate that there is no such service
+for this domain and to not fall back to trying A/AAAA records.
+.next
+Ditto, but for SRV records, when &%check_srv%& is set on this router.
+.next
+MX record points to a non-existent host.
+.next
+MX record points to an IP address and the main section option
+&%allow_mx_to_ip%& is not set.
+.next
+MX records exist and point to valid hosts, but all hosts resolve only to
+addresses blocked by the &%ignore_target_hosts%& generic option on this router.
+.next
+The domain is not syntactically valid (see also &%allow_utf8_domains%& and
+&%dns_check_names_pattern%& for handling one variant of this)
+.next
+&%check_secondary_mx%& is set on this router but the local host can
+not be found in the MX records (see below)
+.endlist
+.wen
+
+

 
 
 .section "Private options for dnslookup" "SECID118"
 
 
 .section "Private options for dnslookup" "SECID118"


@@ -24563,7 +24657,7 @@ made that any particular new authentication mechanism will be supported
 without code changes in Exim.
 
 
 without code changes in Exim.
 
 

-.option server_channelbinding gsasl bool false
+.option server_channelbinding gsasl boolean false

 Some authentication mechanisms are able to use external context at both ends
 of the session to bind the authentication to that context, and fail the
 authentication process if that context differs.  Specifically, some TLS
 Some authentication mechanisms are able to use external context at both ends
 of the session to bind the authentication to that context, and fail the
 authentication process if that context differs.  Specifically, some TLS


@@ -24935,9 +25029,9 @@ There are some differences in usage when using GnuTLS instead of OpenSSL:
 The &%tls_verify_certificates%& option must contain the name of a file, not the
 name of a directory (for OpenSSL it can be either).
 .next
 The &%tls_verify_certificates%& option must contain the name of a file, not the
 name of a directory (for OpenSSL it can be either).
 .next

-The &%tls_dhparam%& option is ignored, because early versions of GnuTLS had no
-facility for varying its Diffie-Hellman parameters. I understand that this has
-changed, but Exim has not been updated to provide this facility.
+.new
+The default value for &%tls_dhparam%& differs for historical reasons.
+.wen

 .next
 .vindex "&$tls_peerdn$&"
 Distinguished Name (DN) strings reported by the OpenSSL library use a slash for
 .next
 .vindex "&$tls_peerdn$&"
 Distinguished Name (DN) strings reported by the OpenSSL library use a slash for


@@ -24945,10 +25039,11 @@ separating fields; GnuTLS uses commas, in accordance with RFC 2253. This
 affects the value of the &$tls_peerdn$& variable.
 .next
 OpenSSL identifies cipher suites using hyphens as separators, for example:
 affects the value of the &$tls_peerdn$& variable.
 .next
 OpenSSL identifies cipher suites using hyphens as separators, for example:

-DES-CBC3-SHA. GnuTLS uses underscores, for example: RSA_ARCFOUR_SHA. What is
-more, OpenSSL complains if underscores are present in a cipher list. To make
-life simpler, Exim changes underscores to hyphens for OpenSSL and hyphens to
-underscores for GnuTLS when processing lists of cipher suites in the
+DES-CBC3-SHA. GnuTLS historically used underscores, for example:
+RSA_ARCFOUR_SHA. What is more, OpenSSL complains if underscores are present
+in a cipher list. To make life simpler, Exim changes underscores to hyphens
+for OpenSSL and passes the string unchanged to GnuTLS (expecting the library
+to handle its own older variants) when processing lists of cipher suites in the

 &%tls_require_ciphers%& options (the global option and the &(smtp)& transport
 option).
 .next
 &%tls_require_ciphers%& options (the global option and the &(smtp)& transport
 option).
 .next


@@ -24964,7 +25059,7 @@ implementation, then patches are welcome.
 .endlist
 
 
 .endlist
 
 

-.section "GnuTLS parameter computation" "SECID181"
+.section "GnuTLS parameter computation" "SECTgnutlsparam"

 .new
 GnuTLS uses D-H parameters that may take a substantial amount of time
 to compute. It is unreasonable to re-compute them for every TLS session.
 .new
 GnuTLS uses D-H parameters that may take a substantial amount of time
 to compute. It is unreasonable to re-compute them for every TLS session.


@@ -24998,14 +25093,18 @@ and letting Exim re-create it, you can generate new parameters using
 renaming. The relevant commands are something like this:
 .code
 # ls
 renaming. The relevant commands are something like this:
 .code
 # ls

-[ look for file; assume gnutls-params-1024 is the most recent ]
+[ look for file; assume gnutls-params-2236 is the most recent ]

 # rm -f new-params
 # touch new-params
 # chown exim:exim new-params
 # chmod 0600 new-params
 # rm -f new-params
 # touch new-params
 # chown exim:exim new-params
 # chmod 0600 new-params

-# certtool --generate-dh-params --bits 1024 >>new-params
+# certtool --generate-dh-params --bits 2236 >>new-params
+# openssl dhparam -noout -text -in new-params | head
+[ check the first line, make sure it's not more than 2236;
+  if it is, then go back to the start ("rm") and repeat
+  until the size generated is at most the size requested ]

 # chmod 0400 new-params
 # chmod 0400 new-params

-# mv new-params gnutls-params-1024
+# mv new-params gnutls-params-2236

 .endd
 If Exim never has to generate the parameters itself, the possibility of
 stalling is removed.
 .endd
 If Exim never has to generate the parameters itself, the possibility of
 stalling is removed.


@@ -25014,10 +25113,24 @@ The filename changed in Exim 4.80, to gain the -bits suffix.  The value which
 Exim will choose depends upon the version of GnuTLS in use.  For older GnuTLS,
 the value remains hard-coded in Exim as 1024.  As of GnuTLS 2.12.x, there is
 a way for Exim to ask for the "normal" number of bits for D-H public-key usage,
 Exim will choose depends upon the version of GnuTLS in use.  For older GnuTLS,
 the value remains hard-coded in Exim as 1024.  As of GnuTLS 2.12.x, there is
 a way for Exim to ask for the "normal" number of bits for D-H public-key usage,

-and Exim does so.  Exim thus removes itself from the policy decision, and the
-filename and bits used change as the GnuTLS maintainers change the value for
-their parameter &`GNUTLS_SEC_PARAM_NORMAL`&.  At the time of writing, this
-gives 2432 bits.
+and Exim does so.  This attempt to remove Exim from TLS policy decisions
+failed, as GnuTLS 2.12 returns a value higher than the current hard-coded limit
+of the NSS library.  Thus Exim gains the &%tls_dh_max_bits%& global option,
+which applies to all D-H usage, client or server.  If the value returned by
+GnuTLS is greater than &%tls_dh_max_bits%& then the value will be clamped down
+to &%tls_dh_max_bits%&.  The default value has been set at the current NSS
+limit, which is still much higher than Exim historically used.
+
+The filename and bits used will change as the GnuTLS maintainers change the
+value for their parameter &`GNUTLS_SEC_PARAM_NORMAL`&, as clamped by
+&%tls_dh_max_bits%&.  At the time of writing (mid 2012), GnuTLS 2.12 recommends
+2432 bits, while NSS is limited to 2236 bits.
+
+In fact, the requested value will be *lower* than &%tls_dh_max_bits%&, to
+increase the chance of the generated prime actually being within acceptable
+bounds, as GnuTLS has been observed to overshoot.  Note the check step in the
+procedure above.  There is no sane procedure available to Exim to double-check
+the size of the generated prime, so it might still be too large.

 .wen
 
 
 .wen
 
 


@@ -25028,7 +25141,10 @@ There is a function in the OpenSSL library that can be passed a list of cipher
 suites before the cipher negotiation takes place. This specifies which ciphers
 are acceptable. The list is colon separated and may contain names like
 DES-CBC3-SHA. Exim passes the expanded value of &%tls_require_ciphers%&
 suites before the cipher negotiation takes place. This specifies which ciphers
 are acceptable. The list is colon separated and may contain names like
 DES-CBC3-SHA. Exim passes the expanded value of &%tls_require_ciphers%&

-directly to this function call. The following quotation from the OpenSSL
+directly to this function call.
+Many systems will install the OpenSSL manual-pages, so you may have
+&'ciphers(1)'& available to you.
+The following quotation from the OpenSSL

 documentation specifies what forms of item are allowed in the cipher string:
 
 .ilist
 documentation specifies what forms of item are allowed in the cipher string:
 
 .ilist


@@ -25065,6 +25181,26 @@ includes any ciphers already present they will be ignored: that is, they will
 not be moved to the end of the list.
 .endlist
 
 not be moved to the end of the list.
 .endlist
 

+.new
+The OpenSSL &'ciphers(1)'& command may be used to test the results of a given
+string:
+.code
+# note single-quotes to get ! past any shell history expansion
+$ openssl ciphers 'HIGH:!MD5:!SHA1'
+.endd
+
+This example will let the library defaults be permitted on the MX port, where
+there's probably no identity verification anyway, but ups the ante on the
+submission ports where the administrator might have some influence on the
+choice of clients used:
+.code
+# OpenSSL variant; see man ciphers(1)
+tls_require_ciphers = ${if =={$received_port}{25}\
+                           {DEFAULT}\
+                           {HIGH:!MD5:!SHA1}}
+.endd
+.wen
+

 
 
 .new
 
 
 .new


@@ -25092,11 +25228,27 @@ aware of future feature enhancements of GnuTLS.
 
 Documentation of the strings accepted may be found in the GnuTLS manual, under
 "Priority strings".  This is online as
 
 Documentation of the strings accepted may be found in the GnuTLS manual, under
 "Priority strings".  This is online as

-&url(http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html).
+&url(http://www.gnu.org/software/gnutls/manual/html_node/Priority-Strings.html),
+but beware that this relates to GnuTLS 3, which may be newer than the version
+installed on your system.  If you are using GnuTLS 3,
+&url(http://www.gnu.org/software/gnutls/manual/html_node/Listing-the-ciphersuites-in-a-priority-string.html, then the example code)
+on that site can be used to test a given string.

 
 Prior to Exim 4.80, an older API of GnuTLS was used, and Exim supported three
 additional options, "&%gnutls_require_kx%&", "&%gnutls_require_mac%&" and
 "&%gnutls_require_protocols%&".  &%tls_require_ciphers%& was an Exim list.
 
 Prior to Exim 4.80, an older API of GnuTLS was used, and Exim supported three
 additional options, "&%gnutls_require_kx%&", "&%gnutls_require_mac%&" and
 "&%gnutls_require_protocols%&".  &%tls_require_ciphers%& was an Exim list.

+
+This example will let the library defaults be permitted on the MX port, where
+there's probably no identity verification anyway, and lowers security further
+by increasing compatibility; but this ups the ante on the submission ports
+where the administrator might have some influence on the choice of clients
+used:
+.code
+# GnuTLS variant
+tls_require_ciphers = ${if =={$received_port}{25}\
+                           {NORMAL:%COMPAT}\
+                           {SECURE128}}
+.endd

 .wen
 
 
 .wen
 
 


@@ -25157,13 +25309,24 @@ this). There is one other option that may be needed in other situations. If
 tls_dhparam = /some/file/name
 .endd
 is set, the SSL library is initialized for the use of Diffie-Hellman ciphers
 tls_dhparam = /some/file/name
 .endd
 is set, the SSL library is initialized for the use of Diffie-Hellman ciphers

-with the parameters contained in the file. This increases the set of cipher
-suites that the server supports. See the command
+with the parameters contained in the file.
+.new
+Set this to &`none`& to disable use of DH entirely, by making no prime
+available:
+.code
+tls_dhparam = none
+.endd
+This may also be set to a string identifying a standard prime to be used for
+DH; if it is set to &`default`& or, for OpenSSL, is unset, then the prime
+used is &`ike23`&.  There are a few standard primes available, see the
+documetnation for &%tls_dhparam%& for the complete list.
+
+See the command

 .code
 openssl dhparam
 .endd
 .code
 openssl dhparam
 .endd

-for a way of generating this data. At present, &%tls_dhparam%& is used only
-when Exim is linked with OpenSSL. It is ignored if GnuTLS is being used.
+for a way of generating file data.
+.wen

 
 The strings supplied for these three options are expanded every time a client
 host connects. It is therefore possible to use different certificates and keys
 
 The strings supplied for these three options are expanded every time a client
 host connects. It is therefore possible to use different certificates and keys