Command-line option for no notifier socket. Bug 2616

[users/jgh/exim.git] / doc / doc-docbook / spec.xfpt

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 8350b4da7b4e2c225b635678876739ad89135807..0ffc88c586de290ca44112325baa7b62a6e02a64 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -4441,6 +4441,27 @@ of the syntax, and how it interacts with configuration file options, are given
 in chapter &<<CHAPinterfaces>>&. When &%-oX%& is used to start a daemon, no pid
 file is written unless &%-oP%& is also present to specify a pid filename.
 
 in chapter &<<CHAPinterfaces>>&. When &%-oX%& is used to start a daemon, no pid
 file is written unless &%-oP%& is also present to specify a pid filename.
 

+.new
+.vitem &%-oY%&
+.oindex &%-oY%&
+.cindex "daemon notifier socket"
+This option controls the creation of an inter-process communications endpoint
+by the Exim daemon.
+It is only relevant when the &%-bd%& (start listening daemon) option is also
+given.
+Normally the daemon creates this socket, unless a &%-oX%& and &*no*& &%-oP%&
+option is also present.
+If this option is given then the socket will not be created.  This could be
+required if the system is running multiple daemons.
+
+The socket is currently used for
+.ilist
+fast ramp-up of queue runner processes
+.next
+obtaining a current queue size
+.endlist
+.wen
+

 .vitem &%-pd%&
 .oindex "&%-pd%&"
 .cindex "Perl" "starting the interpreter"
 .vitem &%-pd%&
 .oindex "&%-pd%&"
 .cindex "Perl" "starting the interpreter"


@@ -6859,6 +6880,13 @@ the implicit key is the host's IP address rather than its name (see section
 &*Warning 3*&: Do not use an IPv4-mapped IPv6 address for a key; use the
 IPv4, in dotted-quad form. (Exim converts IPv4-mapped IPv6 addresses to this
 notation before executing the lookup.)
 &*Warning 3*&: Do not use an IPv4-mapped IPv6 address for a key; use the
 IPv4, in dotted-quad form. (Exim converts IPv4-mapped IPv6 addresses to this
 notation before executing the lookup.)

+
+.new
+One option is supported, "ret=full", to request the return of the entire line
+rather than omitting the key porttion.
+Note however that the key portion will have been de-quoted.
+.wen
+

 .next
 .cindex lookup json
 .cindex json "lookup type"
 .next
 .cindex lookup json
 .cindex json "lookup type"


@@ -8744,8 +8772,13 @@ The value for a match will be the list element string.
 .cindex "tainted data" "de-tainting"
 Note that this is commonly untainted
 (depending on the way the list was created).
 .cindex "tainted data" "de-tainting"
 Note that this is commonly untainted
 (depending on the way the list was created).

+Specifically, explicit text in the configuration file in not tainted.

 This is a useful way of obtaining an untainted equivalent to
 the domain, for later operations.
 This is a useful way of obtaining an untainted equivalent to
 the domain, for later operations.

+
+However if the list (including one-element lists)
+is created by expanding a variable containing tainted data,
+it is tainted and so will the match value be.

 .endlist
 
 
 .endlist
 
 


@@ -12472,25 +12505,32 @@ the complete argument of the ETRN command (see section &<<SECTETRN>>&).
 
 .cindex "tainted data"
 If the origin of the data is an incoming message,
 
 .cindex "tainted data"
 If the origin of the data is an incoming message,

-the result of expanding this variable is tainted.
-When in untainted version is needed, one should be obtained from
+the result of expanding this variable is tainted and may not
+be further expanded or used as a filename.
+When an untainted version is needed, one should be obtained from

 looking up the value in a local (therefore trusted) database.
 Often &$domain_data$& is usable in this role.
 
 
 .vitem &$domain_data$&
 .vindex "&$domain_data$&"
 looking up the value in a local (therefore trusted) database.
 Often &$domain_data$& is usable in this role.
 
 
 .vitem &$domain_data$&
 .vindex "&$domain_data$&"

-When the &%domains%& option on a router matches a domain by
-means of a lookup, the data read by the lookup is available during the running
-of the router as &$domain_data$&. In addition, if the driver routes the
+When the &%domains%& condition on a router
+.new
+or an ACL
+matches a domain
+against a list, the match value is copied to &$domain_data$&.
+This is an enhancement over previous versions of Exim, when it only
+applied to the data read by a lookup.
+For details on match values see section &<<SECTlistresults>>& et. al.
+.wen
+
+If the router routes the

 address to a transport, the value is available in that transport. If the
 transport is handling multiple addresses, the value from the first address is
 used.
 
 address to a transport, the value is available in that transport. If the
 transport is handling multiple addresses, the value from the first address is
 used.
 

-&$domain_data$& is also set when the &%domains%& condition in an ACL matches a
-domain by means of a lookup. The data read by the lookup is available during
-the rest of the ACL statement. In all other situations, this variable expands
-to nothing.
+&$domain_data$& set in an ACL is available during
+the rest of the ACL statement.

 
 .vitem &$exim_gid$&
 .vindex "&$exim_gid$&"
 
 .vitem &$exim_gid$&
 .vindex "&$exim_gid$&"


@@ -12672,7 +12712,8 @@ once.
 
 .cindex "tainted data"
 If the origin of the data is an incoming message,
 
 .cindex "tainted data"
 If the origin of the data is an incoming message,

-the result of expanding this variable is tainted.
+the result of expanding this variable is tainted and
+may not be further expanded or used as a filename.

 
 &*Warning*&: the content of this variable is usually provided by a potential
 attacker.
 
 &*Warning*&: the content of this variable is usually provided by a potential
 attacker.


@@ -12722,19 +12763,17 @@ to process local parts in a case-dependent manner in a router, you can set the
 
 .vitem &$local_part_data$&
 .vindex "&$local_part_data$&"
 
 .vitem &$local_part_data$&
 .vindex "&$local_part_data$&"

-When the &%local_parts%& option on a router matches a local part by means of a
-lookup, the data read by the lookup is available during the running of the
-router as &$local_part_data$&. In addition, if the driver routes the address
-to a transport, the value is available in that transport. If the transport is
-handling multiple addresses, the value from the first address is used.
+When the &%local_parts%& condition on a router or ACL
+matches a local part list
+.new
+the match value is copied to &$local_part_data$&.
+This is an enhancement over previous versions of Exim, when it only
+applied to the data read by a lookup.
+For details on match values see section &<<SECTlistresults>>& et. al.
+.wen

 
 The &%check_local_user%& router option also sets this variable.
 
 
 The &%check_local_user%& router option also sets this variable.
 

-&$local_part_data$& is also set when the &%local_parts%& condition in an ACL
-matches a local part by means of a lookup. The data read by the lookup is
-available during the rest of the ACL statement. In all other situations, this
-variable expands to nothing.
-

 .vindex &$local_part_prefix$& &&&
        &$local_part_prefix_v$& &&&
        &$local_part_suffix$& &&&
 .vindex &$local_part_prefix$& &&&
        &$local_part_prefix_v$& &&&
        &$local_part_suffix$& &&&


@@ -13093,6 +13132,8 @@ The name of the spool queue in use; empty for the default queue.
 .cindex "spool" "number of messages"
 This variable contains the number of messages queued.
 It is evaluated on demand, but no more often than once every minute.
 .cindex "spool" "number of messages"
 This variable contains the number of messages queued.
 It is evaluated on demand, but no more often than once every minute.

+If there is no daemon notifier socket open, the value will be
+an empty string.

 
 .vitem &$r_...$&
 .vindex &$r_...$&
 
 .vitem &$r_...$&
 .vindex &$r_...$&


@@ -13808,6 +13849,8 @@ Observability for TLS session resumption.  See &<<SECTresumption>>& for details.
 .vindex "&$tls_in_sni$&"
 .vindex "&$tls_sni$&"
 .cindex "TLS" "Server Name Indication"
 .vindex "&$tls_in_sni$&"
 .vindex "&$tls_sni$&"
 .cindex "TLS" "Server Name Indication"

+.cindex "TLS" SNI
+.cindex SNI "observability on server"

 When a TLS session is being established, if the client sends the Server
 Name Indication extension, the value will be placed in this variable.
 If the variable appears in &%tls_certificate%& then this option and
 When a TLS session is being established, if the client sends the Server
 Name Indication extension, the value will be placed in this variable.
 If the variable appears in &%tls_certificate%& then this option and


@@ -13823,6 +13866,8 @@ the outbound.
 .vitem &$tls_out_sni$&
 .vindex "&$tls_out_sni$&"
 .cindex "TLS" "Server Name Indication"
 .vitem &$tls_out_sni$&
 .vindex "&$tls_out_sni$&"
 .cindex "TLS" "Server Name Indication"

+.cindex "TLS" SNI
+.cindex SNI "observability in client"

 During outbound
 SMTP deliveries, this variable reflects the value of the &%tls_sni%& option on
 the transport.
 During outbound
 SMTP deliveries, this variable reflects the value of the &%tls_sni%& option on
 the transport.


@@ -16665,10 +16710,16 @@ should need to modify the default.
 The option is expanded before use.
 If the platform supports Linux-style abstract socket names, the result
 is used with a nul byte prefixed.
 The option is expanded before use.
 If the platform supports Linux-style abstract socket names, the result
 is used with a nul byte prefixed.

-Otherwise, it should be a full path name and use a directory accessible
+Otherwise,
+.new "if nonempty,"
+it should be a full path name and use a directory accessible

 to Exim.
 
 to Exim.
 

-If the Exim command line uses a &%-oX%& option and does not use &%-oP%&
+.new
+If this option is set as empty,
+or the command line &%-oY%& option is used, or
+.wen
+the command line uses a &%-oX%& option and does not use &%-oP%&,

 then a notifier socket is not created.
 
 
 then a notifier socket is not created.
 
 


@@ -17990,6 +18041,7 @@ syslog. The value must be no longer than 32 characters. See chapter
 
 .option syslog_timestamp main boolean true
 .cindex "syslog" "timestamps"
 
 .option syslog_timestamp main boolean true
 .cindex "syslog" "timestamps"

+.cindex timestamps syslog

 If &%syslog_timestamp%& is set false, the timestamps on Exim's log lines are
 omitted when these lines are sent to syslog. See chapter &<<CHAPlog>>& for
 details of Exim's logging.
 If &%syslog_timestamp%& is set false, the timestamps on Exim's log lines are
 omitted when these lines are sent to syslog. See chapter &<<CHAPlog>>& for
 details of Exim's logging.


@@ -18145,6 +18197,7 @@ when a list of more than one
 file is used, the &$tls_in_ourcert$& variable is unreliable.
 The macro "_TLS_BAD_MULTICERT_IN_OURCERT" will be defined for those versions.
 
 file is used, the &$tls_in_ourcert$& variable is unreliable.
 The macro "_TLS_BAD_MULTICERT_IN_OURCERT" will be defined for those versions.
 

+.cindex SNI "selecting server certificate based on"

 If the option contains &$tls_out_sni$& and Exim is built against OpenSSL, then
 if the OpenSSL build supports TLS extensions and the TLS client sends the
 Server Name Indication extension, then this option and others documented in
 If the option contains &$tls_out_sni$& and Exim is built against OpenSSL, then
 if the OpenSSL build supports TLS extensions and the TLS client sends the
 Server Name Indication extension, then this option and others documented in


@@ -25697,6 +25750,8 @@ See &<<SECTresumption>>& for details.
 
 .option tls_sni smtp string&!! unset
 .cindex "TLS" "Server Name Indication"
 
 .option tls_sni smtp string&!! unset
 .cindex "TLS" "Server Name Indication"

+.cindex "TLS" SNI
+.cindex SNI "setting in client"

 .vindex "&$tls_sni$&"
 If this option is set then it sets the $tls_out_sni variable and causes any
 TLS session to pass this value as the Server Name Indication extension to
 .vindex "&$tls_sni$&"
 If this option is set then it sets the $tls_out_sni variable and causes any
 TLS session to pass this value as the Server Name Indication extension to


@@ -29299,6 +29354,8 @@ outgoing connection.
 
 .section "Use of TLS Server Name Indication" "SECTtlssni"
 .cindex "TLS" "Server Name Indication"
 
 .section "Use of TLS Server Name Indication" "SECTtlssni"
 .cindex "TLS" "Server Name Indication"

+.cindex "TLS" SNI
+.cindex SNI

 .vindex "&$tls_in_sni$&"
 .oindex "&%tls_in_sni%&"
 With TLS1.0 or above, there is an extension mechanism by which extra
 .vindex "&$tls_in_sni$&"
 .oindex "&%tls_in_sni%&"
 With TLS1.0 or above, there is an extension mechanism by which extra


@@ -35464,14 +35521,14 @@ address if its delivery failed.
 
 
 .section "Per-address filtering" "SECTperaddfil"
 
 
 .section "Per-address filtering" "SECTperaddfil"

-.vindex "&$domain$&"
-.vindex "&$local_part$&"
+.vindex "&$domain_data$&"
+.vindex "&$local_part_data$&"

 In contrast to the system filter, which is run just once per message for each
 delivery attempt, it is also possible to set up a system-wide filtering
 operation that runs once for each recipient address. In this case, variables
 In contrast to the system filter, which is run just once per message for each
 delivery attempt, it is also possible to set up a system-wide filtering
 operation that runs once for each recipient address. In this case, variables

-such as &$local_part$& and &$domain$& can be used, and indeed, the choice of
-filter file could be made dependent on them. This is an example of a router
-which implements such a filter:
+such as &$local_part_data$& and &$domain_data$& can be used,
+and indeed, the choice of filter file could be made dependent on them.
+This is an example of a router which implements such a filter:

 .code
 central_filter:
   check_local_user
 .code
 central_filter:
   check_local_user


@@ -37292,7 +37349,7 @@ follows:
 .code
 my_mailboxes:
   driver = appendfile
 .code
 my_mailboxes:
   driver = appendfile

-  file = /var/mail/$domain/$local_part_data
+  file = /var/mail/$domain_data/$local_part_data

   user = mail
 .endd
 This uses a directory of mailboxes for each domain. The &%user%& setting is
   user = mail
 .endd
 This uses a directory of mailboxes for each domain. The &%user%& setting is


@@ -37332,7 +37389,7 @@ It runs a user's &_.forward_& file for all local parts of the form
 cases by testing the variable &$local_part_suffix$&. For example:
 .code
 if $local_part_suffix contains -special then
 cases by testing the variable &$local_part_suffix$&. For example:
 .code
 if $local_part_suffix contains -special then

-save /home/$local_part/Mail/special
+save /home/$local_part_data/Mail/special

 endif
 .endd
 If the filter file does not exist, or does not deal with such addresses, they
 endif
 .endd
 If the filter file does not exist, or does not deal with such addresses, they


@@ -38678,6 +38735,7 @@ an asterisk is appended to the X= cipher field in the log line.
 .next
 .cindex "log" "TLS SNI"
 .cindex "TLS" "logging SNI"
 .next
 .cindex "log" "TLS SNI"
 .cindex "TLS" "logging SNI"

+.cindex SNI logging

 &%tls_sni%&: When a message is received over an encrypted connection, and
 the remote host provided the Server Name Indication extension, the SNI is
 added to the log line, preceded by SNI=.
 &%tls_sni%&: When a message is received over an encrypted connection, and
 the remote host provided the Server Name Indication extension, the SNI is
 added to the log line, preceded by SNI=.