in chapter &<<CHAPinterfaces>>&. When &%-oX%& is used to start a daemon, no pid
file is written unless &%-oP%& is also present to specify a pid filename.
+.new
+.vitem &%-oY%&
+.oindex &%-oY%&
+.cindex "daemon notifier socket"
+This option controls the creation of an inter-process communications endpoint
+by the Exim daemon.
+It is only relevant when the &%-bd%& (start listening daemon) option is also
+given.
+Normally the daemon creates this socket, unless a &%-oX%& and &*no*& &%-oP%&
+option is also present.
+If this option is given then the socket will not be created. This could be
+required if the system is running multiple daemons.
+
+The socket is currently used for
+.ilist
+fast ramp-up of queue runner processes
+.next
+obtaining a current queue size
+.endlist
+.wen
+
.vitem &%-pd%&
.oindex "&%-pd%&"
.cindex "Perl" "starting the interpreter"
The lookup type may optionally be followed by a comma
and a comma-separated list of options.
Each option is a &"name=value"& pair.
-Whether an option is meaningful depands on the lookup type.
+Whether an option is meaningful depends on the lookup type.
All lookups support the option &"cache=no_rd"&.
If this is given then the cache that Exim manages for lookup results
-is not checked before diong the lookup.
+is not checked before doing the lookup.
The result of the lookup is still written to the cache.
.wen
&*Warning 3*&: Do not use an IPv4-mapped IPv6 address for a key; use the
IPv4, in dotted-quad form. (Exim converts IPv4-mapped IPv6 addresses to this
notation before executing the lookup.)
+
+.new
+One option is supported, "ret=full", to request the return of the entire line
+rather than omitting the key porttion.
+Note however that the key portion will have been de-quoted.
+.wen
+
.next
.cindex lookup json
.cindex json "lookup type"
.cindex "tainted data" "de-tainting"
Note that this is commonly untainted
(depending on the way the list was created).
+Specifically, explicit text in the configuration file in not tainted.
This is a useful way of obtaining an untainted equivalent to
the domain, for later operations.
+
+However if the list (including one-element lists)
+is created by expanding a variable containing tainted data,
+it is tainted and so will the match value be.
.endlist
.section "Local part lists" "SECTlocparlis"
.cindex "list" "local part list"
.cindex "local part" "list"
+These behave in the same way as domain and host lists, with the following
+changes:
+
Case-sensitivity in local part lists is handled in the same way as for address
lists, as just described. The &"+caseful"& item can be used if required. In a
setting of the &%local_parts%& option in a router with &%caseful_local_part%&
is done by calling the &[stat()]& function. The use of the &%exists%& test in
users' filter files may be locked out by the system administrator.
+.new
+&*Note:*& Testing a path using this condition is not a sufficient way of
+de-tainting it.
+.wen
+
.vitem &*first_delivery*&
.cindex "delivery" "first"
.cindex "first delivery"
.cindex "tainted data"
If the origin of the data is an incoming message,
-the result of expanding this variable is tainted.
+the result of expanding this variable is tainted and may not
+be further expanded or used as a filename.
When an untainted version is needed, one should be obtained from
looking up the value in a local (therefore trusted) database.
Often &$domain_data$& is usable in this role.
.vitem &$domain_data$&
.vindex "&$domain_data$&"
-When the &%domains%& option on a router matches a domain by
-means of a lookup, the data read by the lookup is available during the running
-of the router as &$domain_data$&. In addition, if the driver routes the
+When the &%domains%& condition on a router
+.new
+or an ACL
+matches a domain
+against a list, the match value is copied to &$domain_data$&.
+This is an enhancement over previous versions of Exim, when it only
+applied to the data read by a lookup.
+For details on match values see section &<<SECTlistresults>>& et. al.
+.wen
+
+If the router routes the
address to a transport, the value is available in that transport. If the
transport is handling multiple addresses, the value from the first address is
used.
-&$domain_data$& is also set when the &%domains%& condition in an ACL matches a
-domain by means of a lookup. The data read by the lookup is available during
-the rest of the ACL statement. In all other situations, this variable expands
-to nothing.
+&$domain_data$& set in an ACL is available during
+the rest of the ACL statement.
.vitem &$exim_gid$&
.vindex "&$exim_gid$&"
.cindex "tainted data"
If the origin of the data is an incoming message,
-the result of expanding this variable is tainted.
+the result of expanding this variable is tainted and
+may not be further expanded or used as a filename.
&*Warning*&: the content of this variable is usually provided by a potential
attacker.
.vitem &$local_part_data$&
.vindex "&$local_part_data$&"
-When the &%local_parts%& option on a router matches a local part by means of a
-lookup, the data read by the lookup is available during the running of the
-router as &$local_part_data$&. In addition, if the driver routes the address
-to a transport, the value is available in that transport. If the transport is
-handling multiple addresses, the value from the first address is used.
+When the &%local_parts%& condition on a router or ACL
+matches a local part list
+.new
+the match value is copied to &$local_part_data$&.
+This is an enhancement over previous versions of Exim, when it only
+applied to the data read by a lookup.
+For details on match values see section &<<SECTlistresults>>& et. al.
+.wen
The &%check_local_user%& router option also sets this variable.
-&$local_part_data$& is also set when the &%local_parts%& condition in an ACL
-matches a local part by means of a lookup. The data read by the lookup is
-available during the rest of the ACL statement. In all other situations, this
-variable expands to nothing.
-
.vindex &$local_part_prefix$& &&&
&$local_part_prefix_v$& &&&
&$local_part_suffix$& &&&
.cindex "spool" "number of messages"
This variable contains the number of messages queued.
It is evaluated on demand, but no more often than once every minute.
+If there is no daemon notifier socket open, the value will be
+an empty string.
.vitem &$r_...$&
.vindex &$r_...$&
The option is expanded before use.
If the platform supports Linux-style abstract socket names, the result
is used with a nul byte prefixed.
-Otherwise, it should be a full path name and use a directory accessible
+Otherwise,
+.new "if nonempty,"
+it should be a full path name and use a directory accessible
to Exim.
-If the Exim command line uses a &%-oX%& option and does not use &%-oP%&
+.new
+If this option is set as empty,
+or the command line &%-oY%& option is used, or
+.wen
+the command line uses a &%-oX%& option and does not use &%-oP%&,
then a notifier socket is not created.
used to determine the file or directory name for the delivery. Normally, the
contents of &$address_file$& are used in some way in the string expansion.
.endlist
+If the &%create_file%& option is set to a path which
+matches (see the option definition below for details)
+a file or directory name
+for the delivery, that name becomes de-tainted.
+
.cindex "tainted data" "in filenames"
.cindex appendfile "tainted data"
Tainted data may not be used for a file or directory name.
delivery, it applies to the top level directory, not the maildir directories
beneath.
+.new
The option must be set to one of the words &"anywhere"&, &"inhome"&, or
-&"belowhome"&. In the second and third cases, a home directory must have been
-set for the transport. This option is not useful when an explicit filename is
+&"belowhome"&, or to an absolute path.
+.wen
+
+In the second and third cases, a home directory must have been
+set for the transport, and the file or directory being created must
+reside within it.
+The "belowhome" checking additionally checks for attempts to use "../"
+to evade the testing.
+This option is not useful when an explicit filename is
given for normal mailbox deliveries. It is intended for the case when filenames
are generated from users' &_.forward_& files. These are usually handled
by an &(appendfile)& transport called &%address_file%&. See also
&%file_must_exist%&.
+.new
+In the fourth case,
+the value given for this option must be an absolute path for an
+existing directory.
+The value is used for checking instead of a home directory;
+checking is done in "belowhome" mode.
+
+.cindex "tainted data" "de-tainting"
+If "belowhome" checking is used, the file or directory path
+becomes de-tainted.
+.wen
+
.option directory appendfile string&!! unset
This option is mutually exclusive with the &%file%& option, but one of &%file%&
(see &%maildir_format%& and &%mailstore_format%&), and see section
&<<SECTopdir>>& for further details of this form of delivery.
+.new
+The result of expansion must not be tainted, unless the &%create_file%& option
+specifies a path.
+.wen
+
.option directory_file appendfile string&!! "see below"
.cindex "base62"
&%use_fcntl_lock%&, &%use_flock_lock%&, or &%use_lockfile%& must be set with
&%file%&.
+.new
+The result of expansion must not be tainted, unless the &%create_file%& option
+specifies a path.
+.wen
+
.cindex "NFS" "lock file"
.cindex "locking files"
.cindex "lock files"
.section "Per-address filtering" "SECTperaddfil"
-.vindex "&$domain$&"
-.vindex "&$local_part$&"
+.vindex "&$domain_data$&"
+.vindex "&$local_part_data$&"
In contrast to the system filter, which is run just once per message for each
delivery attempt, it is also possible to set up a system-wide filtering
operation that runs once for each recipient address. In this case, variables
-such as &$local_part$& and &$domain$& can be used, and indeed, the choice of
-filter file could be made dependent on them. This is an example of a router
-which implements such a filter:
+such as &$local_part_data$& and &$domain_data$& can be used,
+and indeed, the choice of filter file could be made dependent on them.
+This is an example of a router which implements such a filter:
.code
central_filter:
check_local_user
.code
my_mailboxes:
driver = appendfile
- file = /var/mail/$domain/$local_part_data
+ file = /var/mail/$domain_data/$local_part_data
user = mail
.endd
This uses a directory of mailboxes for each domain. The &%user%& setting is
cases by testing the variable &$local_part_suffix$&. For example:
.code
if $local_part_suffix contains -special then
-save /home/$local_part/Mail/special
+save /home/$local_part_data/Mail/special
endif
.endd
If the filter file does not exist, or does not deal with such addresses, they
&'reject '& The DMARC check failed and the library recommends rejecting the email.
&'quarantine '& The DMARC check failed and the library recommends keeping it for further inspection.
&'none '& The DMARC check passed and the library recommends no specific action, neutral.
-&'norecord '& No policy section in the DMARC record for this sender domain.
+&'norecord '& No policy section in the DMARC record for this RFC5322.From field
&'nofrom '& Unable to determine the domain of the sender.
&'temperror '& Library error or dns error.
&'off '& The DMARC check was disabled for this email.
git://git.exim.org / users / jgh / exim.git / blobdiff