X-Git-Url: https://git.exim.org/users/jgh/exim.git/blobdiff_plain/7fcd7cd65f514c57b0670633c4d8d9583294f6a9..610ff4388b33ddc2753c17eefb8b03e2fdd7e124:/doc/doc-docbook/spec.xfpt diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index 0e070d082..b2b703b45 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -6892,10 +6892,8 @@ white space is ignored. For an MX lookup, both the preference value and the host name are returned for each record, separated by a space. For an SRV lookup, the priority, weight, port, and host name are returned for each record, separated by spaces. -.new An alternate field separator can be specified using a comma after the main separator character, followed immediately by the field separator. -.wen .cindex "TXT record" "in &(dnsdb)& lookup" .cindex "SPF record" "in &(dnsdb)& lookup" @@ -7347,15 +7345,12 @@ If you specify multiple attributes, the result contains space-separated, quoted strings, each preceded by the attribute name and an equals sign. Within the quotes, the quote character, backslash, and newline are escaped with backslashes, and commas are used to separate multiple values for the attribute. -.new Any commas in attribute values are doubled (permitting treatment of the values as a comma-separated list). -.wen Apart from the escaping, the string within quotes takes the same form as the output when a single attribute is requested. Specifying no attributes is the same as specifying all of an entry's attributes. -.new Here are some examples of the output format. The first line of each pair is an LDAP query, and the second is the data that is returned. The attribute called &%attr1%& has two values, one of them with an embedded comma, whereas @@ -7373,18 +7368,15 @@ attr1="value1.1,value1,,2" attr2="value two" ldap:///o=base??sub?(uid=fred) objectClass="top" attr1="value1.1,value1,,2" attr2="value two" .endd -.wen You can make use of Exim's &%-be%& option to run expansion tests and thereby check the results of LDAP lookups. The &%extract%& operator in string expansions can be used to pick out individual fields from data that consists of &'key'&=&'value'& pairs. -.new The &%listextract%& operator should be used to pick out individual values of attributes, even when only a single value is expected. The doubling of embedded commas allows you to use the returned data as a comma separated list (using the "<," syntax for changing the input list separator). -.wen @@ -9705,7 +9697,6 @@ the regular expression from string expansion. -.new .vitem &*${sort{*&<&'string'&>&*}{*&<&'comparator'&>&*}{*&<&'extractor'&>&*}}*& .cindex sorting a list .cindex list sorting @@ -9733,7 +9724,6 @@ sorts a list of numbers, and ${sort {$lookup dnsdb{>:,,mx=example.com}} {<} {${listextract{1}{<,$item}}}} .endd will sort an MX lookup into priority order. -.wen .vitem &*${substr{*&<&'string1'&>&*}{*&<&'string2'&>&*}{*&<&'string3'&>&*}}*& @@ -12414,9 +12404,7 @@ If TLS has not been negotiated, the value will be 0. This variable refers to the certificate presented to the peer of an inbound connection when the message was received. It is only useful as the argument of a -.new &%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator, -.wen or a &%def%& condition. .vitem &$tls_in_peercert$& @@ -12424,27 +12412,21 @@ or a &%def%& condition. This variable refers to the certificate presented by the peer of an inbound connection when the message was received. It is only useful as the argument of a -.new &%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator, -.wen or a &%def%& condition. .vitem &$tls_out_ourcert$& .vindex "&$tls_out_ourcert$&" This variable refers to the certificate presented to the peer of an outbound connection. It is only useful as the argument of a -.new &%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator, -.wen or a &%def%& condition. .vitem &$tls_out_peercert$& .vindex "&$tls_out_peercert$&" This variable refers to the certificate presented by the peer of an outbound connection. It is only useful as the argument of a -.new &%certextract%& expansion item, &%md5%&, &%sha1%& or &%sha256%& operator, -.wen or a &%def%& condition. .vitem &$tls_in_certificate_verified$& @@ -13564,8 +13546,9 @@ This option defines the ACL that is run after an SMTP DATA command has been processed and the message itself has been received, but before the final acknowledgment is sent. See chapter &<>& for further details. -.option acl_smtp_data_prdr main string&!! unset -.cindex "DATA" "ACL for" +.option acl_smtp_data_prdr main string&!! accept +.cindex "PRDR" "ACL for" +.cindex "DATA" "PRDR ACL for" .cindex "&ACL;" "PRDR-related" .cindex "&ACL;" "per-user data processing" This option defines the ACL that, @@ -16495,17 +16478,28 @@ preference order of the available ciphers. Details are given in sections See &%tls_verify_hosts%& below. -.option tls_verify_certificates main string&!! unset +.option tls_verify_certificates main string&!! system .cindex "TLS" "client certificate verification" .cindex "certificate" "verification of client" -The value of this option is expanded, and must then be the absolute path to -a file containing permitted certificates for clients that -match &%tls_verify_hosts%& or &%tls_try_verify_hosts%&. Alternatively, if you -are using either GnuTLS version 3.3.6 (or later) or OpenSSL, -you can set &%tls_verify_certificates%& to the name of a -directory containing certificate files. -For earlier versions of GnuTLS -the option must be set to the name of a single file. +The value of this option is expanded, and must then be either the +word "system" +or the absolute path to +a file or directory containing permitted certificates for clients that +match &%tls_verify_hosts%& or &%tls_try_verify_hosts%&. + +The "system" value for the option will use a +system default location compiled into the SSL library. +This is not available for GnuTLS versions preceding 3.0.20, +and will be taken as empty; an explicit location +must be specified. + +The use of a directory for the option value is not avilable for GnuTLS versions +preceding 3.3.6 and a single file must be used. + +With OpenSSL the certificates specified +explicitly +either by file or directory +are added to those given by the system default location. With OpenSSL the certificates specified explicitly @@ -16886,7 +16880,6 @@ If the expansion fails (other than forced failure) delivery is deferred. Some of the other precondition options are common special cases that could in fact be specified using &%condition%&. -.new Historical note: We have &%condition%& on ACLs and on Routers. Routers are far older, and use one set of semantics. ACLs are newer and when they were created, the ACL &%condition%& process was given far stricter @@ -16926,7 +16919,6 @@ true, as the result of expansion is a non-empty string which doesn't match an explicit false value. This can be tricky to debug. By contrast, in an ACL either of those strings will always result in an expansion error because the result doesn't look sufficiently boolean. -.wen .option debug_print routers string&!! unset @@ -23182,11 +23174,12 @@ connects. If authentication fails, Exim will try to transfer the message unauthenticated. See also &%hosts_require_auth%&, and chapter &<>& for details of authentication. -.option hosts_try_prdr smtp "host list&!!" unset +.option hosts_try_prdr smtp "host list&!!" * .cindex "PRDR" "enabling, optional in client" This option provides a list of servers to which, provided they announce PRDR support, Exim will attempt to negotiate PRDR for multi-recipient messages. +The option can usually be left as default. .option interface smtp "string list&!!" unset .cindex "bind IP address" @@ -23244,7 +23237,7 @@ so can cause parallel connections to the same host if &%remote_max_parallel%& permits this. -.option multi_domain smtp boolean true +.option multi_domain smtp boolean&!! true .vindex "&$domain$&" When this option is set, the &(smtp)& transport can handle a number of addresses containing a mixture of different domains provided they all resolve @@ -23253,6 +23246,9 @@ handling only one domain at a time. This is useful if you want to use &$domain$& in an expansion for the transport, because it is set only when there is a single domain involved in a remote delivery. +It is expanded per-address and can depend on any of +&$address_data$&, &$domain_data$&, &$local_part_data$&, +&$host$&, &$host_address$& and &$host_port$&. .option port smtp string&!! "see below" .cindex "port" "sending TCP/IP" @@ -23288,7 +23284,7 @@ connecting, as an outbound SSL-on-connect, instead of using STARTTLS to upgrade. The Internet standards bodies strongly discourage use of this mode. -.option retry_include_ip_address smtp boolean true +.option retry_include_ip_address smtp boolean&!! true Exim normally includes both the host name and the IP address in the key it constructs for indexing retry data after a temporary delivery failure. This means that when one of several IP addresses for a host is failing, it gets @@ -23298,9 +23294,8 @@ addresses is not affected. However, in some dialup environments hosts are assigned a different IP address each time they connect. In this situation the use of the IP address as part of the retry key leads to undesirable behaviour. Setting this option false causes -Exim to use only the host name. This should normally be done on a separate -instance of the &(smtp)& transport, set up specially to handle the dialup -hosts. +Exim to use only the host name. +Since it is expanded it can be made to depend on the host or domain. .option serialize_hosts smtp "host list&!!" unset @@ -23438,7 +23433,7 @@ unknown state), opens a new one to the same host, and then tries the delivery in clear. -.option tls_try_verify_hosts smtp "host list&!!" unset +.option tls_try_verify_hosts smtp "host list&!!" * .cindex "TLS" "server certificate verification" .cindex "certificate" "verification of server" This option gives a list of hosts for which, on encrypted connections, @@ -23451,20 +23446,37 @@ The &$tls_out_certificate_verified$& variable is set when certificate verification succeeds. -.option tls_verify_certificates smtp string&!! unset +.option tls_verify_cert_hostnames smtp "host list&!!" * +.cindex "TLS" "server certificate hostname verification" +.cindex "certificate" "verification of server" +This option give a list of hosts for which, +while verifying the server certificate, +checks will be included on the host name +(note that this will generally be the result of a DNS MX lookup) +versus Subject and Subject-Alternate-Name fields. Wildcard names are permitted +limited to being the initial component of a 3-or-more component FQDN. + +There is no equivalent checking on client certificates. + + +.option tls_verify_certificates smtp string&!! system .cindex "TLS" "server certificate verification" .cindex "certificate" "verification of server" .vindex "&$host$&" .vindex "&$host_address$&" -The value of this option must be the absolute path to a file containing -permitted server certificates, for use when setting up an encrypted connection. -Alternatively, -if you are using either GnuTLS version 3.3.6 (or later) or OpenSSL, -you can set -&%tls_verify_certificates%& to the name of a directory containing certificate -files. -For earlier versions of GnuTLS the option must be set to the name of a -single file. +The value of this option must be either the +word "system" +or the absolute path to +a file or directory containing permitted certificates for servers, +for use when setting up an encrypted connection. + +The "system" value for the option will use a location compiled into the SSL library. +This is not available for GnuTLS versions preceding 3.0.20; a value of "system" +is taken as empty and an explicit location +must be specified. + +The use of a directory for the option value is not avilable for GnuTLS versions +preceding 3.3.6 and a single file must be used. With OpenSSL the certificates specified explicitly @@ -23477,6 +23489,7 @@ expansion of this option. See chapter &<>& for details of TLS. For back-compatability, if neither tls_verify_hosts nor tls_try_verify_hosts are set +(a single-colon empty list counts as being set) and certificate verification fails the TLS connection is closed. @@ -25952,8 +25965,9 @@ include files and libraries for GnuTLS can be found. There are some differences in usage when using GnuTLS instead of OpenSSL: .ilist -The &%tls_verify_certificates%& option must contain the name of a file, not the -name of a directory for GnuTLS versions before 3.3.6 +The &%tls_verify_certificates%& option +cannot be the path of a directory +for GnuTLS versions before 3.3.6 (for later versions, or OpenSSL, it can be either). .next The default value for &%tls_dhparam%& differs for historical reasons. @@ -26305,8 +26319,10 @@ session with a client, you must set either &%tls_verify_hosts%& or apply to all TLS connections. For any host that matches one of these options, Exim requests a certificate as part of the setup of the TLS session. The contents of the certificate are verified by comparing it with a list of -expected certificates. These must be available in a file or, -for OpenSSL only (not GnuTLS), a directory, identified by +expected certificates. +These may be the system default set (depending on library version), +an explicit file or, +depending on library version, a directory, identified by &%tls_verify_certificates%&. A file can contain multiple certificates, concatenated end to end. If a @@ -26466,9 +26482,13 @@ if it requests it. If the server is Exim, it will request a certificate only if &%tls_verify_hosts%& or &%tls_try_verify_hosts%& matches the client. If the &%tls_verify_certificates%& option is set on the &(smtp)& transport, it +specifies a collection of expected server certificates. +These may be the system default set (depeding on library version), +a file or, +depnding on liibrary version, a directory, must name a file or, -for OpenSSL only (not GnuTLS), a directory, that contains a collection of -expected server certificates. The client verifies the server's certificate +for OpenSSL only (not GnuTLS), a directory. +The client verifies the server's certificate against this collection, taking into account any revoked certificates that are in the list defined by &%tls_crl%&. Failure to verify fails the TLS connection unless either of the @@ -26937,6 +26957,7 @@ This ACL is evaluated after &%acl_smtp_dkim%& but before &%acl_smtp_data%&. .section "The SMTP PRDR ACL" "SECTPRDRACL" +.cindex "PRDR" "ACL for" .oindex "&%prdr_enable%&" The &%acl_smtp_data_prdr%& ACL is available only when Exim is compiled with PRDR support enabled (which is the default). @@ -26945,8 +26966,9 @@ client and server for a message, and more than one recipient has been accepted. The ACL test specfied by &%acl_smtp_data_prdr%& happens after a message -has been recieved, and is executed for each recipient of the message. -The test may accept or deny for inividual recipients. +has been recieved, and is executed once for each recipient of the message +with &$local_part$& and &$domain$& valid. +The test may accept, defer or deny for inividual recipients. The &%acl_smtp_data%& will still be called after this ACL and can reject the message overall, even if this ACL has accepted it for some or all recipients. @@ -27775,10 +27797,8 @@ anyway. If the message contains newlines, this gives rise to a multi-line SMTP response. .vindex "&$acl_verify_message$&" -.new For ACLs that are called by an &%acl =%& ACL condition, the message is stored in &$acl_verify_message$&, from which the calling ACL may use it. -.wen If &%message%& is used on a statement that verifies an address, the message specified overrides any message that is generated by the verification process. @@ -35347,11 +35367,9 @@ given message, or all mail for a given user, or for a given host, for example. The input files can be in Exim log format or syslog format. If a matching log line is not associated with a specific message, it is included in &'exigrep'&'s output without any additional lines. The usage is: -.new .display &`exigrep [-t<`&&'n'&&`>] [-I] [-l] [-M] [-v] <`&&'pattern'&&`> [<`&&'log file'&&`>] ...`& .endd -.wen If no log file names are given on the command line, the standard input is read. The &%-t%& argument specifies a number of seconds. It adds an additional @@ -35371,7 +35389,6 @@ regular expression. The &%-v%& option inverts the matching condition. That is, a line is selected if it does &'not'& match the pattern. -.new The &%-M%& options means &"related messages"&. &'exigrep'& will show messages that are generated as a result/response to a message that &'exigrep'& matched normally. @@ -35384,7 +35401,6 @@ the second (bounce) message will be displayed. Using &%-M%& with &'exigrep'& when searching for &"user_a"& will show both messages since the bounce is &"related"& to or a &"result"& of the first message that was found by the search term. -.wen If the location of a &'zcat'& command is known from the definition of ZCAT_COMMAND in &_Local/Makefile_&, &'exigrep'& automatically passes any file