It is only useful as the argument of a
&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
or a &%def%& condition.
+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.
.vitem &$tls_out_ourcert$&
.vindex "&$tls_out_ourcert$&"
outbound connection. It is only useful as the argument of a
&%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator,
or a &%def%& condition.
+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.
.vitem &$tls_in_certificate_verified$&
.vindex "&$tls_in_certificate_verified$&"
connection, and Exim is configured to request a certificate from the client,
the value of the Distinguished Name of the certificate is made available in the
&$tls_in_peerdn$& during subsequent processing.
+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.
The deprecated &$tls_peerdn$& variable refers to the inbound side
except when used in the context of an outbound SMTP delivery, when it refers to
connection, and Exim is configured to request a certificate from the server,
the value of the Distinguished Name of the certificate is made available in the
&$tls_out_peerdn$& during subsequent processing.
+If certificate verification fails it may refer to a failing chain element
+which is not the leaf.
.vitem &$tls_in_sni$&
.vindex "&$tls_in_sni$&"
.option headers_add routers list&!! unset
.cindex "header lines" "adding"
.cindex "router" "adding header lines"
-This option specifies a list of text headers, newline-separated,
+This option specifies a list of text headers,
+.new
+newline-separated (by default, changeable in the usual way),
+.wen
that is associated with any addresses that are accepted by the router.
Each item is separately expanded, at routing time. However, this
option has no effect when an address is just being verified. The way in which
.option headers_remove routers list&!! unset
.cindex "header lines" "removing"
.cindex "router" "removing header lines"
-This option specifies a list of text headers, colon-separated,
+This option specifies a list of text headers,
+.new
+colon-separated (by default, changeable in the usual way),
+.wen
that is associated with any addresses that are accepted by the router.
Each item is separately expanded, at routing time. However, this
option has no effect when an address is just being verified. The way in which
.option headers_add transports list&!! unset
.cindex "header lines" "adding in transport"
.cindex "transport" "header lines; adding"
-This option specifies a list of text headers, newline-separated,
+This option specifies a list of text headers,
+.new
+newline-separated (by default, changeable in the usual way),
+.wen
which are (separately) expanded and added to the header
portion of a message as it is transported, as described in section
&<<SECTheadersaddrem>>&. Additional header lines can also be specified by
.option headers_remove transports list&!! unset
.cindex "header lines" "removing"
.cindex "transport" "header lines; removing"
-This option specifies a list of header names, colon-separated;
+This option specifies a list of header names,
+.new
+colon-separated (by default, changeable in the usual way);
+.wen
these headers are omitted from the message as it is transported, as described
in section &<<SECTheadersaddrem>>&. Header removal can also be specified by
routers.
This daemon-type scanner is GPL and free. You can get it at
&url(http://www.clamav.net/). Some older versions of clamd do not seem to
unpack MIME containers, so it used to be recommended to unpack MIME attachments
-in the MIME ACL. This no longer believed to be necessary. One option is
-required: either the path and name of a UNIX socket file, or a hostname or IP
-number, and a port, separated by space, as in the second of these examples:
+in the MIME ACL. This is no longer believed to be necessary.
+
+The options are a list of server specifiers, which may be
+a UNIX socket specification,
+a TCP socket specification,
+or a (global) option.
+
+A socket specification consists of a space-separated list.
+For a Unix socket the first element is a full path for the socket,
+for a TCP socket the first element is the IP address
+and the second a port number,
+Any further elements are per-server (non-global) options.
+These per-server options are supported:
+.code
+retry=<timespec> Retry on connect fail
+.endd
+
+The &`retry`& option specifies a time after which a single retry for
+a failed connect is made. The default is to not retry.
+
+If a Unix socket file is specified, only one server is supported.
+
+Examples:
.code
av_scanner = clamd:/opt/clamd/socket
av_scanner = clamd:192.0.2.3 1234
av_scanner = clamd:192.0.2.3 1234:local
+av_scanner = clamd:192.0.2.3 1234 retry=10s
av_scanner = clamd:192.0.2.3 1234 : 192.0.2.4 1234
.endd
-If the value of av_scanner points to a UNIX socket file or contains the local
-keyword, then the ClamAV interface will pass a filename containing the data
+If the value of av_scanner points to a UNIX socket file or contains the
+&`local`&
+option, then the ClamAV interface will pass a filename containing the data
to be scanned, which will should normally result in less I/O happening and be
more efficient. Normally in the TCP case, the data is streamed to ClamAV as
Exim does not assume that there is a common filesystem with the remote host.
The &%spam%& ACL condition calls SpamAssassin's &%spamd%& daemon to get a spam
score and a report for the message.
.new
-Support is also provided for Rspamd (which can speak SpamAssassin's protocol but
-provides reduced functionality when used in this mode).
+Support is also provided for Rspamd.
For more information about installation and configuration of SpamAssassin or
Rspamd refer to their respective websites at
are options.
The supported option are:
.code
-variant=rspamd Use Rspamd rather than SpamAssassin protocol
-time=<start>-<end> Use only between these times of day
+pri=<priority> Selection priority
weight=<value> Selection bias
-backup Use only if all non-backup servers fail
+time=<start>-<end> Use only between these times of day
+retry=<timespec> Retry on connect fail
+tmo=<timespec> Connection time limit
+variant=rspamd Use Rspamd rather than SpamAssassin protocol
.endd
+The &`pri`& option specifies a priority for the server within the list,
+higher values being tried first.
+The deafult priority is 1.
+
+The &`weight`& option specifies a selection bias.
+Within a priority set
+servers are queried in a random fashion, weighted by this value.
+The default value for selection bias is 1.
+
Time specifications for the &`time`& option are <hour>.<minute>.<second>
in the local time zone; each element being one or more digits.
+Either the seconds or both minutes and seconds, plus the leading &`.`&
+characters, may be omitted and will be taken as zero.
-Servers are queried in a random fashion, weighted by the selection bias.
-The default value for selection bias is 1.
+Timeout specifications for the &`retry`& and &`tmo`& options
+are the usual Exim time interval standard, eg. &`20s`& or &`1m`&.
+
+The &`tmo`& option specifies an overall timeout for communication.
+The default value is two minutes.
+
+The &`retry`& option specifies a time after which a single retry for
+a failed connect is made.
+The default is to not retry.
.wen
The &%spamd_address%& variable is expanded before use if it starts with
&%spam%& condition has to be called from a DATA ACL in order to be able to
read the contents of the message, the variables &$local_part$& and &$domain$&
are not set.
+Careful enforcement of single-recipient messages
+(eg. by responding with defer in the recipient ACL for all recipients
+after the first),
+or the use of PRDR,
+.cindex "PRDR" "use for per-user SpamAssassin profiles"
+are needed to use this feature.
The right-hand side of the &%spam%& condition is expanded before being used, so
you can put lookups or conditions there. When the right-hand side evaluates to
git://git.exim.org / users / jgh / exim.git / blobdiff