X-Git-Url: https://git.exim.org/users/jgh/exim.git/blobdiff_plain/2eaf5372acd23eb6fa0cdcf64ee711f95b784712..9ac22119716d965a167beaa3f98e0569ca9ff3d7:/doc/doc-docbook/spec.xfpt diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index da4b7ec84..7e59c304d 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -1860,7 +1860,7 @@ described RFC 2047. This makes it possible to transmit characters that are not in the ASCII character set, and to label them as being in a particular character set. When Exim is inspecting header lines by means of the &%$h_%& mechanism, it decodes them, and translates them into a specified character set -(default ISO-8859-1). The translation is possible only if the operating system +(default is set at build time). The translation is possible only if the operating system supports the &[iconv()]& function. However, some of the operating systems that supply &[iconv()]& do not support @@ -3107,8 +3107,12 @@ users, the output is as in this example: .code mysql_servers = .endd -If &%configure_file%& is given as an argument, the name of the run time -configuration file is output. +If &%config%& is given as an argument, the config is +output, as it was parsed, any include file resolved, any comment removed. + +If &%config_file%& is given as an argument, the name of the run time +configuration file is output. (&%configure_file%& works too, for +backward compatibility.) If a list of configuration files was supplied, the value that is output here is the name of the file that was actually used. @@ -3548,6 +3552,9 @@ example: exim '-D ABC = something' ... .endd &%-D%& may be repeated up to 10 times on a command line. +.new +Only macro names up to 22 letters long can be set. +.wen .vitem &%-d%&<&'debug&~options'&> @@ -6617,6 +6624,14 @@ password value. For example: &(pgsql)&: The format of the query is an SQL statement that is passed to a PostgreSQL database. See section &<>&. +.next +.new +.cindex "Redis lookup type" +.cindex lookup Redis +&(redis)&: The format of the query is an SQL statement that is passed to a +Redis database. See section &<>&. +.wen + .next .cindex "sqlite lookup type" .cindex "lookup" "sqlite" @@ -7307,6 +7322,8 @@ The value of the DEREFERENCE parameter must be one of the words &"never"&, must be &"follow"& (the default) or &"nofollow"&. The latter stops the LDAP library from trying to follow referrals issued by the LDAP server. +.cindex LDAP timeout +.cindex timeout "LDAP lookup" The name CONNECT is an obsolete name for NETTIME, retained for backwards compatibility. This timeout (specified as a number of seconds) is enforced from the client end for operations that can be carried out over a @@ -7381,7 +7398,7 @@ SMTP authentication. See the &%ldapauth%& expansion string condition in chapter The &(ldapdn)& lookup type returns the Distinguished Name from a single entry as a sequence of values, for example .code -cn=manager, o=University of Cambridge, c=UK +cn=manager,o=University of Cambridge,c=UK .endd The &(ldap)& lookup type generates an error if more than one entry matches the search filter, whereas &(ldapm)& permits this case, and inserts a newline in @@ -7392,7 +7409,8 @@ directory. In the common case where you specify a single attribute in your LDAP query, the result is not quoted, and does not contain the attribute name. If the attribute -has multiple values, they are separated by commas. +has multiple values, they are separated by commas. Any comma that is +part of an attribute's value is doubled. If you specify multiple attributes, the result contains space-separated, quoted strings, each preceded by the attribute name and an equals sign. Within the @@ -7407,7 +7425,9 @@ same as specifying all of an entry's attributes. Here are some examples of the output format. The first line of each pair is an LDAP query, and the second is the data that is returned. The attribute called &%attr1%& has two values, one of them with an embedded comma, whereas -&%attr2%& has only one value: +&%attr2%& has only one value. Both attributes are derived from &%attr%& +(they have SUP &%attr%& in their schema definitions). + .code ldap:///o=base?attr1?sub?(uid=fred) value1.1,value1,,2 @@ -7415,6 +7435,9 @@ value1.1,value1,,2 ldap:///o=base?attr2?sub?(uid=fred) value two +ldap:///o=base?attr?sub?(uid=fred) +value1.1,value1,,2,value two + ldap:///o=base?attr1,attr2?sub?(uid=fred) attr1="value1.1,value1,,2" attr2="value two" @@ -7474,7 +7497,10 @@ operator is to double any quote characters within the text. .cindex "lookup" "Oracle" .cindex "InterBase lookup type" .cindex "lookup" "InterBase" -Exim can support lookups in InterBase, MySQL, Oracle, PostgreSQL, and SQLite +.cindex "Redis lookup type" +.cindex lookup Redis +Exim can support lookups in InterBase, MySQL, Oracle, PostgreSQL, Redis, +and SQLite databases. Queries for these databases contain SQL statements, so an example might be .code @@ -7501,7 +7527,7 @@ If the result of the query yields more than one row, it is all concatenated, with a newline between the data for each row. -.section "More about MySQL, PostgreSQL, Oracle, and InterBase" "SECID72" +.section "More about MySQL, PostgreSQL, Oracle, InterBase, and Redis" "SECID72" .cindex "MySQL" "lookup type" .cindex "PostgreSQL lookup type" .cindex "lookup" "MySQL" @@ -7510,13 +7536,18 @@ with a newline between the data for each row. .cindex "lookup" "Oracle" .cindex "InterBase lookup type" .cindex "lookup" "InterBase" -If any MySQL, PostgreSQL, Oracle, or InterBase lookups are used, the -&%mysql_servers%&, &%pgsql_servers%&, &%oracle_servers%&, or &%ibase_servers%& +.cindex "Redis lookup type" +.cindex lookup Redis +If any MySQL, PostgreSQL, Oracle, InterBase or Redis lookups are used, the +&%mysql_servers%&, &%pgsql_servers%&, &%oracle_servers%&, &%ibase_servers%&, +or &%redis_servers%& option (as appropriate) must be set to a colon-separated list of server information. -(For MySQL and PostgreSQL only, the global option need not be set if all +(For MySQL and PostgreSQL, the global option need not be set if all queries contain their own server information &-- see section -&<>&.) Each item in the list is a slash-separated list of four +&<>&.) +For all but Redis +each item in the list is a slash-separated list of four items: host name, database name, user name, and password. In the case of Oracle, the host name field is used for the &"service name"&, and the database name field is not used and should be empty. For example: @@ -7537,16 +7568,36 @@ a query is successfully processed. The result of a query may be that no data is found, but that is still a successful query. In other words, the list of servers provides a backup facility, not a list of different places to look. +.new +For Redis the global option need not be specified if all queries contain their +own server information &-- see section &<>&. +If specified, the option must be set to a colon-separated list of server +information. +Each item in the list is a slash-separated list of three items: +host, database number, and password. +.olist +The host is required and may be either an IPv4 address and optional +port number (separated by a colon, which needs doubling due to the +higher-level list), or a Unix socket pathname enclosed in parentheses +.next +The database number is optional; if present that number is selected in the backend +.next +The password is optional; if present it is used to authenticate to the backend +.endlist +.wen + +.new The &%quote_mysql%&, &%quote_pgsql%&, and &%quote_oracle%& expansion operators convert newline, tab, carriage return, and backspace to \n, \t, \r, and \b respectively, and the characters single-quote, double-quote, and backslash -itself are escaped with backslashes. The &%quote_pgsql%& expansion operator, in -addition, escapes the percent and underscore characters. This cannot be done -for MySQL because these escapes are not recognized in contexts where these -characters are not special. +itself are escaped with backslashes. + +The &%quote_redis%& expansion operator +escapes whitespace and backslash characters with a backslash. +.wen .section "Specifying the server in the query" "SECTspeserque" -For MySQL and PostgreSQL lookups (but not currently for Oracle and InterBase), +For MySQL, PostgreSQL and Redis lookups (but not currently for Oracle and InterBase), it is possible to specify a list of servers with an individual query. This is done by starting the query with .display @@ -7589,13 +7640,17 @@ ${lookup pgsql{servers=master/db/name/pw; UPDATE ...} } .section "Special MySQL features" "SECID73" For MySQL, an empty host name or the use of &"localhost"& in &%mysql_servers%& causes a connection to the server on the local host by means of a Unix domain -socket. An alternate socket can be specified in parentheses. The full syntax of -each item in &%mysql_servers%& is: +socket. An alternate socket can be specified in parentheses. +.new +An option group name for MySQL option files can be specified in square brackets; +the default value is &"exim"&. +.wen +The full syntax of each item in &%mysql_servers%& is: .display -<&'hostname'&>::<&'port'&>(<&'socket name'&>)/<&'database'&>/&&& - <&'user'&>/<&'password'&> +<&'hostname'&>::<&'port'&>(<&'socket name'&>)[<&'option group'&>]/&&& + <&'database'&>/<&'user'&>/<&'password'&> .endd -Any of the three sub-parts of the first field can be omitted. For normal use on +Any of the four sub-parts of the first field can be omitted. For normal use on the local host it can be left blank or set to just &"localhost"&. No database need be supplied &-- but if it is absent here, it must be given in @@ -7647,6 +7702,8 @@ domainlist relay_to_domains = sqlite;/some/thing/sqlitedb \ The only character affected by the &%quote_sqlite%& operator is a single quote, which it doubles. +.cindex timeout SQLite +.cindex sqlite "lookup timeout" The SQLite library handles multiple simultaneous accesses to the database internally. Multiple readers are permitted, but only one process can update at once. Attempts to access the database while it is being updated @@ -9353,6 +9410,19 @@ you can use condition = ${if >{$acl_m4}{3}} .endd + + +.new +.vitem &*${imapfolder{*&<&'foldername'&>&*}}*& +.cindex expansion "imap folder" +.cindex "&%imapfolder%& expansion item" +This item converts a (possibly multilevel, or with non-ASCII characters) +folder specification to a Maildir name for filesystem use. +For information on internationalisation support see &<>&. +.wen + + + .vitem &*${length{*&<&'string1'&>&*}{*&<&'string2'&>&*}}*& .cindex "expansion" "string truncation" .cindex "&%length%& expansion item" @@ -10108,6 +10178,27 @@ as is, and other byte values are converted to &`\xNN`&, for example a byte value 127 is converted to &`\x7f`&. +.new +.vitem &*${ipv6denorm:*&<&'string'&>&*}*& +.cindex "&%ipv6denorm%& expansion item" +.cindex "IP address" normalisation +This expands an IPv6 address to a full eight-element colon-separated set +of hex digits including leading zeroes. +A trailing ipv4-style dotted-decimal set is converted to hex. +Pure IPv4 addresses are converted to IPv4-mapped IPv6. + +.vitem &*${ipv6norm:*&<&'string'&>&*}*& +.cindex "&%ipv6norm%& expansion item" +.cindex "IP address" normalisation +.cindex "IP address" "canonical form" +This converts an IPv6 address to canonical form. +Leading zeroes of groups are omitted, and the longest +set of zero-valued groups is replaced with a double colon. +A trailing ipv4-style dotted-decimal set is converted to hex. +Pure IPv4 addresses are converted to IPv4-mapped IPv6. +.wen + + .vitem &*${lc:*&<&'string'&>&*}*& .cindex "case forcing in strings" .cindex "string" "case forcing" @@ -10191,11 +10282,14 @@ Letters in IPv6 addresses are always output in lower case. .vitem &*${md5:*&<&'string'&>&*}*& .cindex "MD5 hash" .cindex "expansion" "MD5 hash" -.cindex "certificate fingerprint" +.cindex certificate fingerprint .cindex "&%md5%& expansion item" The &%md5%& operator computes the MD5 hash value of the string, and returns it as a 32-digit hexadecimal number, in which any letters are in lower case. +If the string is a single variable of type certificate, +returns the MD5 hash fingerprint of the certificate. + .vitem &*${nhash_*&<&'n'&>&*_*&<&'m'&>&*:*&<&'string'&>&*}*& .cindex "expansion" "numeric hash" @@ -10291,7 +10385,7 @@ f.7.2.0.0.0.0.c.d.c.b.a.1.0.0.0.9.0.0.0.2.4.c.0.8.b.d.0.1.0.0.2 This operator encodes text according to the rules of RFC 2047. This is an encoding that is used in header lines to encode non-ASCII characters. It is assumed that the input string is in the encoding specified by the -&%headers_charset%& option, which defaults to ISO-8859-1. If the string +&%headers_charset%& option, which gets its default at build time. If the string contains only characters in the range 33&--126, and no instances of the characters .code @@ -10329,15 +10423,18 @@ variables or headers inside regular expressions. .vitem &*${sha1:*&<&'string'&>&*}*& .cindex "SHA-1 hash" .cindex "expansion" "SHA-1 hashing" -.cindex "certificate fingerprint" +.cindex certificate fingerprint .cindex "&%sha2%& expansion item" The &%sha1%& operator computes the SHA-1 hash value of the string, and returns it as a 40-digit hexadecimal number, in which any letters are in upper case. +If the string is a single variable of type certificate, +returns the SHA-1 hash fingerprint of the certificate. + .vitem &*${sha256:*&<&'certificate'&>&*}*& .cindex "SHA-256 hash" -.cindex "certificate fingerprint" +.cindex certificate fingerprint .cindex "expansion" "SHA-256 hashing" .cindex "&%sha256%& expansion item" The &%sha256%& operator computes the SHA-256 hash fingerprint of the @@ -10423,6 +10520,23 @@ This forces the letters in the string into upper-case. .cindex "expansion" "utf-8 forcing" .cindex "&%utf8clean%& expansion item" This replaces any invalid utf-8 sequence in the string by the character &`?`&. + +.new +.vitem "&*${utf8_domain_to_alabel:*&<&'string'&>&*}*&" &&& + "&*${utf8_domain_from_alabel:*&<&'string'&>&*}*&" &&& + "&*${utf8_localpart_to_alabel:*&<&'string'&>&*}*&" &&& + "&*${utf8_localpart_from_alabel:*&<&'string'&>&*}*&" +.cindex expansion UTF-8 +.cindex UTF-8 expansion +.cindex EAI +.cindex internationalisation +.cindex "&%utf8_domain_to_alabel%& expansion item" +.cindex "&%utf8_domain_from_alabel%& expansion item" +.cindex "&%utf8_localpart_to_alabel%& expansion item" +.cindex "&%utf8_localpart_from_alabel%& expansion item" +These convert EAI mail name components between UTF-8 and a-label forms. +For information on internationalisation support see &<>&. +.wen .endlist @@ -11219,7 +11333,7 @@ this variable holds the pipe command when the transport is running. .vitem "&$auth1$& &-- &$auth3$&" .vindex "&$auth1$&, &$auth2$&, etc" These variables are used in SMTP authenticators (see chapters -&<>&&--&<>&). Elsewhere, they are empty. +&<>&&--&<>&). Elsewhere, they are empty. .vitem &$authenticated_id$& .cindex "authentication" "id" @@ -11380,7 +11494,8 @@ see section &<>&. &$dkim_key_nosubdomains$& &&& &$dkim_key_srvtype$& &&& &$dkim_key_granularity$& &&& - &$dkim_key_notes$& + &$dkim_key_notes$& &&& + &$dkim_key_length$& These variables are only available within the DKIM ACL. For details see chapter &<>&. @@ -11990,6 +12105,24 @@ a single-component name, Exim calls &[gethostbyname()]& (or qualified host name. See also &$smtp_active_hostname$&. +.new +.vitem &$proxy_host_address$& &&& + &$proxy_host_port$& &&& + &$proxy_target_address$& &&& + &$proxy_target_port$& &&& + &$proxy_session$& +These variables are only available when built with Proxy Protocol +or Socks5 support +For details see chapter &<>&. +.wen + +.new +.vitem &$prdr_requested$& +.cindex "PRDR" "variable for" +This variable is set to &"yes"& if PRDR was requested by the client for the +current message, otherwise &"no"&. +.wen + .vitem &$prvscheck_address$& This variable is used in conjunction with the &%prvscheck%& expansion item, which is described in sections &<>& and @@ -12547,6 +12680,7 @@ If TLS has not been negotiated, the value will be 0. .vitem &$tls_in_ourcert$& .vindex "&$tls_in_ourcert$&" +.cindex certificate veriables This variable refers to the certificate presented to the peer of an inbound connection when the message was received. It is only useful as the argument of a @@ -12637,6 +12771,7 @@ See &$tls_in_ocsp$& for values. .vitem &$tls_in_peerdn$& .vindex "&$tls_in_peerdn$&" .vindex "&$tls_peerdn$&" +.cindex certificate "extracting fields" When a message is received from a remote host over an encrypted SMTP connection, and Exim is configured to request a certificate from the client, the value of the Distinguished Name of the certificate is made available in the @@ -13279,6 +13414,7 @@ listed in more than one group. .section "Logging" "SECID99" .table2 +.row &%event_action%& "custom logging" .row &%hosts_connection_nolog%& "exemption from connect logging" .row &%log_file_path%& "override compiled-in value" .row &%log_selector%& "set/unset optional logging" @@ -13420,6 +13556,7 @@ listed in more than one group. .row &%helo_verify_hosts%& "HELO hard-checked for these hosts" .row &%host_lookup%& "host name looked up for these hosts" .row &%host_lookup_order%& "order of DNS and local name lookups" +.row &%hosts_proxy%& "use proxy protocol for these hosts" .row &%host_reject_connection%& "reject connection from these hosts" .row &%hosts_treat_as_local%& "useful in some cluster configurations" .row &%local_scan_timeout%& "timeout for &[local_scan()]&" @@ -13554,6 +13691,7 @@ See also the &'Policy controls'& section above. .row &%ignore_fromline_local%& "allow &""From ""& from local SMTP" .row &%pipelining_advertise_hosts%& "advertise pipelining to these hosts" .row &%prdr_enable%& "advertise PRDR to all hosts" +.row &%smtputf8_advertise_hosts%& "advertise SMTPUTF8 to these hosts" .row &%tls_advertise_hosts%& "advertise TLS to these hosts" .endtable @@ -14430,6 +14568,14 @@ own &'Reply-To:'& header line, the value of the &%errors_reply_to%& option is not used. +.new +.option event_action main string&!! unset +.cindex events +This option declares a string to be expanded for Exim's events mechanism. +For details see &<>&. +.wen + + .option exim_group main string "compile-time configured" .cindex "gid (group id)" "Exim's own" .cindex "Exim group" @@ -14775,6 +14921,14 @@ If the &%smtp_connection%& log selector is not set, this option has no effect. +.new +.option hosts_proxy main "host list&!!" unset +.cindex proxy "proxy protocol" +This option enables use of Proxy Protocol proxies for incoming +connections. For details see &<>&. +.wen + + .option hosts_treat_as_local main "domain list&!!" unset .cindex "local host" "domains treated as" .cindex "host" "treated as local" @@ -14851,6 +15005,7 @@ logged. .option ldap_ca_cert_dir main string unset .cindex "LDAP", "TLS CA certificate directory" +.cindex certificate "directory for LDAP" This option indicates which directory contains CA certificates for verifying a TLS certificate presented by an LDAP server. While Exim does not provide a default value, your SSL library may. @@ -14860,6 +15015,7 @@ and constrained to be a directory. .option ldap_ca_cert_file main string unset .cindex "LDAP", "TLS CA certificate file" +.cindex certificate "file for LDAP" This option indicates which file contains CA certificates for verifying a TLS certificate presented by an LDAP server. While Exim does not provide a default value, your SSL library may. @@ -14869,6 +15025,7 @@ and constrained to be a file. .option ldap_cert_file main string unset .cindex "LDAP" "TLS client certificate file" +.cindex certificate "file for LDAP" This option indicates which file contains an TLS client certificate which Exim should present to the LDAP server during TLS negotiation. Should be used together with &%ldap_cert_key%&. @@ -14876,6 +15033,7 @@ Should be used together with &%ldap_cert_key%&. .option ldap_cert_key main string unset .cindex "LDAP" "TLS client key file" +.cindex certificate "key for LDAP" This option indicates which file contains the secret/private key to use to prove identity to the LDAP server during TLS negotiation. Should be used together with &%ldap_cert_file%&, which contains the @@ -16309,6 +16467,17 @@ example, instead of &"Administrative prohibition"&, it might give: 550 failing address in "From" header is: >& for details of Exim's support for internationalisation. +.wen + + .option spamd_address main string "see below" This option is available when Exim is compiled with the content-scanning extension. It specifies how Exim connects to SpamAssassin's &%spamd%& daemon. @@ -16552,7 +16721,9 @@ runs. This is appropriate behaviour for obtaining wall-clock time on some, but unfortunately not all, operating systems. -.option tls_advertise_hosts main "host list&!!" unset +.new +.option tls_advertise_hosts main "host list&!!" * +.wen .cindex "TLS" "advertising" .cindex "encryption" "on SMTP connection" .cindex "SMTP" "encrypted connection" @@ -16560,6 +16731,11 @@ When Exim is built with support for TLS encrypted connections, the availability of the STARTTLS command to set up an encrypted session is advertised in response to EHLO only to those client hosts that match this option. See chapter &<>& for details of Exim's support for TLS. +.new +Note that the default value requires that a certificate be supplied +using the &%tls_certificate%& option. If no certificate is available then +the &%tls_advertise_hosts%& option should be set empty. +.wen .option tls_certificate main string&!! unset @@ -20438,6 +20614,13 @@ its removal from incoming messages, so that delivered messages can safely be resent to other recipients. +.option event_action transports string&!! unset +.cindex events +This option declares a string to be expanded for Exim's events mechanism. +For details see &<>&. +.wen + + .option group transports string&!! "Exim group" .cindex "transport" "group; specifying" This option specifies a gid for running the transport process, overriding any @@ -20711,6 +20894,9 @@ headers that some sites insist on. This option sets up a filtering (in the Unix shell sense) process for messages at transport time. It should not be confused with mail filtering as set up by individual users or via a system filter. +.new +If unset, or expanding to an empty string, no filtering is done. +.wen When the message is about to be written out, the command specified by &%transport_filter%& is started up in a separate, parallel process, and @@ -23670,6 +23856,14 @@ Alternatively, if the value of &%size_addition%& is set negative, it disables the use of the SIZE option altogether. +.new +.option socks_proxy smtp string&!! unset +.cindex proxy SOCKS +This option enables use of SOCKS proxies for connections made by the +transport. For details see &<>&. +.wen + + .option tls_certificate smtp string&!! unset .cindex "TLS" "client certificate, location of" .cindex "certificate" "client, location of" @@ -24303,7 +24497,7 @@ replaced, not just the working part. The replacement must be a complete RFC 2822 address, including the angle brackets if necessary. If text outside angle brackets contains a character whose value is greater than 126 or less than 32 (except for tab), the text is encoded according to RFC 2047. The character set -is taken from &%headers_charset%&, which defaults to ISO-8859-1. +is taken from &%headers_charset%&, which gets its default at build time. When the &"w"& flag is set on a rule that causes an envelope address to be rewritten, all but the working part of the replacement address is discarded. @@ -26279,6 +26473,24 @@ tls: } } } } server_set_id = ${if = {1}{${listcount:$auth1}} {$auth1}{}} .endd +This accepts a client certificate that is verifiable against any +of your configured trust-anchors +which usually means the full set of public CAs) +and which has a SAN with a good account name. +Note that the client cert is on the wire in-clear, including the SAN, +whereas a plaintext SMTP AUTH done inside TLS is not. + +. An alternative might use +. .code +. server_param1 = ${sha256:$tls_in_peercert} +. .endd +. to require one of a set of specific certs that define a given account +. (the verification is still required, but mostly irrelevant). +. This would help for per-device use. +. +. However, for the future we really need support for checking a +. user cert in LDAP - which probably wants a base-64 DER. + .ecindex IIDtlsauth1 .ecindex IIDtlsauth2 @@ -27394,8 +27606,12 @@ for some or all recipients. PRDR may be used to support per-user content filtering. Without it one must defer any recipient after the first that has a different content-filter configuration. With PRDR, the RCPT-time check -for this can be disabled when the MAIL-time $smtp_command included -"PRDR". Any required difference in behaviour of the main DATA-time +.new +.cindex "PRDR" "variable for" +for this can be disabled when the variable &$prdr_requested$& +is &"yes"&. +.wen +Any required difference in behaviour of the main DATA-time ACL should however depend on the PRDR-time ACL having run, as Exim will avoid doing so in some situations (e.g. single-recipient mails). @@ -28574,6 +28790,13 @@ data is read. &*Note:*& This control applies only to the current message, not to any others that are being submitted at the same time using &%-bs%& or &%-bS%&. + +.new +.vitem &*control&~=&~utf8_downconvert*& +This control enables conversion of UTF-8 in message addresses +to a-label form. +For details see &<>&. +.wen .endlist vlist @@ -35124,6 +35347,7 @@ extensions (ESMTP), encryption, or authentication were used. If the SMTP session was encrypted, there is an additional X field that records the cipher suite that was used. +.cindex log protocol The protocol is set to &"esmtpsa"& or &"esmtpa"& for messages received from hosts that have authenticated themselves using the SMTP AUTH command. The first value is used when the SMTP connection was encrypted (&"secure"&). In this case @@ -35148,7 +35372,7 @@ data when a message is received. See section &<>& below. .cindex "log" "delivery line" The format of the single-line entry in the main log that is written for every delivery is shown in one of the examples below, for local and remote -deliveries, respectively. Each example has been split into two lines in order +deliveries, respectively. Each example has been split into multiple lines in order to fit it on the page: .code 2002-10-31 08:59:13 16ZCW1-0005MB-00 => marv @@ -35294,6 +35518,7 @@ the following table: &`id `& message id for incoming message &`P `& on &`<=`& lines: protocol used &` `& on &`=>`& and &`**`& lines: return path +&`PRX `& on &'<='& and&`=>`& lines: proxy address &`QT `& on &`=>`& lines: time spent on queue so far &` `& on &"Completed"& lines: time spent on queue &`R `& on &`<=`& lines: reference for local bounce @@ -35390,6 +35615,9 @@ selection marked by asterisks: &` queue_time `& time on queue for one recipient &` queue_time_overall `& time on queue for whole message &` pid `& Exim process id +.new +&` proxy `& proxy address on <= and => lines +.wen &` received_recipients `& recipients on <= lines &` received_sender `& sender on <= lines &`*rejected_header `& header contents on reject log @@ -35516,6 +35744,17 @@ rejection lines, and (despite the name) to outgoing &"=>"& and &"->"& lines. The latter can be disabled by turning off the &%outgoing_interface%& option. .wen .next +.new +.cindex log "incoming proxy address" +.cindex proxy "logging proxy address" +.cindex "TCP/IP" "logging proxy address" +&%proxy%&: The internal (closest to the system running Exim) IP address +of the proxy, tagged by PRX=, on the &"<="& line for a message accepted +on a proxied connection +or the &"=>"& line for a message delivered on a proxied connection.. +See &<>& for more information. +.wen +.next .cindex "log" "incoming remote port" .cindex "port" "logging remote" .cindex "TCP/IP" "logging incoming remote port" @@ -37678,7 +37917,7 @@ be tracked on a per-domain basis, rather than merely upon source IP address. DKIM is documented in RFC 4871. Since version 4.70, DKIM support is compiled into Exim by default. It can be -disabled by setting DISABLE_DKIM=yes in Local/Makefile. +disabled by setting DISABLE_DKIM=yes in &_Local/Makefile_&. Exim's DKIM implementation allows to .olist @@ -37904,6 +38143,8 @@ Key granularity (tag g=) from the key record. Defaults to "*" if not specified in the key record. .vitem &%$dkim_key_notes%& Notes from the key record (tag n=). +.vitem &%$dkim_key_length%& +Number of bits in the key. .endlist In addition, two ACL conditions are provided: @@ -37943,6 +38184,390 @@ for more information of what they mean. . //////////////////////////////////////////////////////////////////////////// . //////////////////////////////////////////////////////////////////////////// +.chapter "Proxies" "CHAPproxies" &&& + "Proxy support" +.cindex "proxy support" +.cindex "proxy" "access via" + +.new +A proxy is an intermediate system through which communication is passed. +Proxies may provide a security, availability or load-distribution function. + + +.section "Inbound proxies" SECTproxyInbound +.cindex proxy inbound +.cindex proxy "server side" +.cindex proxy "Proxy protocol" +.cindex "Proxy protocol" proxy + +Exim has support for receiving inbound SMTP connections via a proxy +that uses &"Proxy Protocol"& to speak to it. +To include this support, include &"SUPPORT_PROXY=yes"& +in Local/Makefile. + +It was built on specifications from: +http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt +That URL was revised in May 2014 to version 2 spec: +http://git.1wt.eu/web?p=haproxy.git;a=commitdiff;h=afb768340c9d7e50d8e + +The purpose of this facility is so that an application load balancer, +such as HAProxy, can sit in front of several Exim servers +to distribute load. +Exim uses the local protocol communication with the proxy to obtain +the remote SMTP system IP address and port information. +There is no logging if a host passes or +fails Proxy Protocol negotiation, but it can easily be determined and +recorded in an ACL (example is below). + +Use of a proxy is enabled by setting the &%hosts_proxy%& +main configuration option to a hostlist; connections from these +hosts will use Proxy Protocol. + +The following expansion variables are usable +(&"internal"& and &"external"& here refer to the interfaces +of the proxy): +.display +&'proxy_host_address '& internal IP address of the proxy +&'proxy_host_port '& internal TCP port of the proxy +&'proxy_target_address '& external IP address of the proxy +&'proxy_target_port '& external TCP port of the proxy +&'proxy_session '& boolean: SMTP connection via proxy +.endd +If &$proxy_session$& is set but &$proxy_host_address$& is empty +there was a protocol error. + +Since the real connections are all coming from the proxy, and the +per host connection tracking is done before Proxy Protocol is +evaluated, &%smtp_accept_max_per_host%& must be set high enough to +handle all of the parallel volume you expect per inbound proxy. +With the option set so high, you lose the ability +to protect your server from many connections from one IP. +In order to prevent your server from overload, you +need to add a per connection ratelimit to your connect ACL. +A possible solution is: +.display + # Set max number of connections per host + LIMIT = 5 + # Or do some kind of IP lookup in a flat file or database + # LIMIT = ${lookup{$sender_host_address}iplsearch{/etc/exim/proxy_limits}} + + defer message = Too many connections from this IP right now + ratelimit = LIMIT / 5s / per_conn / strict +.endd + + + +.section "Outbound proxies" SECTproxySOCKS +.cindex proxy outbound +.cindex proxy "client side" +.cindex proxy SOCKS +.cindex SOCKS proxy +Exim has support for sending outbound SMTP via a proxy +using a protocol called SOCKS5 (defined by RFC1928). +The support can be optionally included by defining SUPPORT_SOCKS=yes in +Local/Makefile. + +Use of a proxy is enabled by setting the &%socks_proxy%& option +on an smtp transport. +The option value is expanded and should then be a list +(colon-separated by default) of proxy specifiers. +Each proxy specifier is a list +(space-separated by default) where the initial element +is an IP address and any subsequent elements are options. + +Options are a string =. +The list of options is in the following table: +.display +&'auth '& authentication method +&'name '& authentication username +&'pass '& authentication password +&'port '& tcp port +&'tmo '& connection timeout +&'pri '& priority +&'weight '& selection bias +.endd + +More details on each of these options follows: + +.ilist +.cindex authentication "to proxy" +.cindex proxy authentication +&%auth%&: Either &"none"& (default) or &"name"&. +Using &"name"& selects username/password authentication per RFC 1929 +for access to the proxy. +Default is &"none"&. +.next +&%name%&: sets the username for the &"name"& authentication method. +Default is empty. +.next +&%pass%&: sets the password for the &"name"& authentication method. +Default is empty. +.next +&%port%&: the TCP port number to use for the connection to the proxy. +Default is 1080. +.next +&%tmo%&: sets a connection timeout in seconds for this proxy. +Default is 5. +.next +&%pri%&: specifies a priority for the proxy within the list, +higher values being tried first. +The default priority is 1. +.next +&%weight%&: specifies a selection bias. +Within a priority set servers are queried in a random fashion, +weighted by this value. +The default value for selection bias is 1. +.endlist + +Proxies from the list are tried according to their priority +and weight settings until one responds. The timeout for the +overall connection applies to the set of proxied attempts. + +.section Logging SECTproxyLog +To log the (local) IP of a proxy in the incoming or delivery logline, +add &"+proxy"& to the &%log_selector%& option. +This will add a component tagged with &"PRX="& to the line. +.wen + +. //////////////////////////////////////////////////////////////////////////// +. //////////////////////////////////////////////////////////////////////////// + +.chapter "Internationalisation" "CHAPi18n" &&& + "Internationalisation"" +.cindex internationalisation "email address" +.cindex EAI +.cindex i18n +.cindex UTF-8 "mail name handling" + +.new +Exim has support for Internationalised mail names. +To include this it must be built with SUPPORT_I18N and the libidn library. +Standards supported are RFCs 2060, 5890, 6530 and 6533. + +.section "MTA operations" SECTi18nMTA +.cindex SMTPUTF8 "ESMTP option" +The main configuration option &%smtputf8_advertise_hosts%& specifies +a host list. If this matches the sending host and +accept_8bitmime is true (the default) then the ESMTP option +SMTPUTF8 will be advertised. + +If the sender specifies the SMTPUTF8 option on a MAIL command +international handling for the message is enabled and +the expansion variable &$message_smtputf8$& will have value TRUE. + +The option &%allow_utf8_domains%& is set to true for this +message. All DNS lookups are converted to a-label form +whatever the setting of &%allow_utf8_domains%& +when Exim is built with SUPPORT_I18N. + +Both localparts and domain are maintained as the original +UTF-8 form internally; any comparison or regular-expression use will +require appropriate care. Filenames created, eg. by +the appendfile transport, will have UTF-8 names. + +HELO names sent by the smtp transport will have any UTF-8 +components expanded to a-label form, +and any certificate name checks will be done using the a-label +form of the name. + +.cindex log protocol +.cindex SMTPUTF8 logging +Log lines and Received-by: header lines will acquire a "utf8" +prefix on the protocol element, eg. utf8esmtp. + +The following expansion operator can be used: +.code +${utf8_domain_to_alabel:str} +${utf8_domain_from_alabel:str} +${utf8_localpart_to_alabel:str} +${utf8_localpart_from_alabel:str} +.endd + +ACLs may use the following modifier: +.display +control = utf8_downconvert +control = utf8_downconvert/ +.endd +This sets a flag requiring that addresses are converted to +a-label form before smtp delivery, for use in a +Message Submission Agent context. +If a value is appended it may be: +.display +&`1 `& (default) mandatory downconversion +&`0 `& no downconversion +&`-1 `& if SMTPUTF8 not supported by destination host +.endd + +If mua_wrapper is set, the utf8_downconvert control +is initially set to -1. + + +There is no explicit support for VRFY and EXPN. +Configurations supporting these should inspect +&$smtp_command_argument$& for an SMTPUTF8 argument. + +There is no support for LMTP on Unix sockets. +Using the "lmtp" protocol option on an smtp transport, +for LMTP over TCP, should work as expected. + +There is no support for DSN unitext handling, +and no provision for converting logging from or to UTF-8. + + + +.section "MDA operations" SECTi18nMDA +To aid in constructing names suitable for IMAP folders +the following expansion operator can be used: +.code +${imapfolder {} {} {}} +.endd + +The string is converted from the charset specified by +the "headers charset" command (in a filter file) +or &%headers_charset%& main configuration option (otherwise), +to the +modified UTF-7 encoding specified by RFC 2060, +with the following exception: All occurences of +(which has to be a single character) +are replaced with periods ("."), and all periods and slashes that are not + and are not in the string are BASE64 encoded. + +The third argument can be omitted, defaulting to an empty string. +The second argument can be omitted, defaulting to "/". + +This is the encoding used by Courier for Maildir names on disk, and followed +by many other IMAP servers. + +Examples: +.display +&`${imapfolder {Foo/Bar}} `& yields &`Foo.Bar`& +&`${imapfolder {Foo/Bar}{.}{/}} `& yields &`Foo&&AC8-Bar`& +&`${imapfolder {Räksmörgås}} `& yields &`R&&AOQ-ksm&&APY-rg&&AOU-s`& +.endd + +Note that the source charset setting is vital, and also that characters +must be representable in UTF-16. + +.wen + +. //////////////////////////////////////////////////////////////////////////// +. //////////////////////////////////////////////////////////////////////////// + +.chapter "Events" "CHAPevents" &&& + "Events" +.cindex events + +.new +The events mechanism in Exim can be used to intercept processing at a number +of points. It was originally invented to giave a way to do customised logging +actions (for example, to a database) but can also be used to modify some +processing actions. + +Most installations will never need to use Events. +The support can be left out of a build by defining DISABLE_EVENT=yes +in &_Local/Makefile_&. + +There are two major classes of events: main and transport. +The main configuration option &%event_action%& controls reception events; +a transport option &%event_action%& controls delivery events. + +Both options are a string which is expanded when the event fires. +An example might look like: +.cindex logging custom +.code +event_action = ${if eq {msg:delivery}{$event_name} \ +{${lookup pgsql {SELECT * FROM record_Delivery( \ + '${quote_pgsql:$sender_address_domain}',\ + '${quote_pgsql:${lc:$sender_address_local_part}}', \ + '${quote_pgsql:$domain}', \ + '${quote_pgsql:${lc:$local_part}}', \ + '${quote_pgsql:$host_address}', \ + '${quote_pgsql:${lc:$host}}', \ + '${quote_pgsql:$message_exim_id}')}} \ +} {}} +.endd + +Events have names which correspond to the point in process at which they fire. +The name is placed in the variable &$event_name$& and the event action +expansion must check this, as it will be called for every possible event type. + +The current list of events is: +.display +&`msg:complete after main `& per message +&`msg:delivery after transport `& per recipient +&`msg:rcpt:host:defer after transport `& per recipient per host +&`msg:rcpt:defer after transport `& per recipient +&`msg:host:defer after transport `& per attempt +&`msg:fail:delivery after main `& per recipient +&`msg:fail:internal after main `& per recipient +&`tcp:connect before transport `& per connection +&`tcp:close after transport `& per connection +&`tls:cert before both `& per certificate in verification chain +&`smtp:connect after transport `& per connection +.endd +New event types may be added in future. + +The event name is a colon-separated list, defining the type of +event in a tree of possibilities. It may be used as a list +or just matched on as a whole. There will be no spaces in the name. + +The second column in the table above describes whether the event fires +before or after the action is associates with. Those which fire before +can be used to affect that action (more on this below). + +An additional variable, &$event_data$&, is filled with information varying +with the event type: +.display +&`msg:delivery `& smtp confirmation mssage +&`msg:rcpt:host:defer `& error string +&`msg:rcpt:defer `& error string +&`msg:host:defer `& error string +&`tls:cert `& verification chain depth +&`smtp:connect `& smtp banner +.endd + +The :defer events populate one extra variable: &$event_defer_errno$&. + +For complex operations an ACL expansion can be used in &%event_action%& +however due to the multiple contextx that Exim operates in during +the course of its processing: +.ilist +variables set in transport events will not be visible outside that +transport call +.next +acl_m variables in a server context are lost on a new connection, +and after smtp helo/ehlo/mail/starttls/rset commands +.endlist +Using an ACL expansion with the logwrite modifier can be +a useful way of writing to the main log. + +The expansion of the event_action option should normally +return an empty string. Should it return anything else the +following will be forced: +.display +&`msg:delivery `& (ignored) +&`msg:host:defer `& (ignored) +&`msg:fail:delivery`& (ignored) +&`tcp:connect `& do not connect +&`tcp:close `& (ignored) +&`tls:cert `& refuse verification +&`smtp:connect `& close connection +.endd +No other use is made of the result string. + +For a tcp:connect event, if the connection is being made to a proxy +then the address and port variables will be that of the proxy and not +the target system. + +For tls:cert events, if GnuTLS is in use this will trigger only per +chain element received on the connection. +For OpenSSL it will trigger for every chain element including those +loaded locally. +.wen + +. //////////////////////////////////////////////////////////////////////////// +. //////////////////////////////////////////////////////////////////////////// + .chapter "Adding new drivers or lookup types" "CHID13" &&& "Adding drivers or lookups" .cindex "adding drivers"