X-Git-Url: https://git.exim.org/users/jgh/exim.git/blobdiff_plain/e6060e2ce135caa2d48e682c4d76d071ff760a30..55c75993b43ac91069a5fbe9cc7a8d48cda84ee0:/doc/doc-docbook/spec.xfpt diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index 9541d6e06..2a69fcf59 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -1,4 +1,4 @@ -. $Cambridge: exim/doc/doc-docbook/spec.xfpt,v 1.59 2009/10/16 09:51:12 nm4 Exp $ +. $Cambridge: exim/doc/doc-docbook/spec.xfpt,v 1.76 2010/06/05 10:04:43 pdp Exp $ . . ///////////////////////////////////////////////////////////////////////////// . This is the primary source of the Exim Manual. It is an xfpt document that is @@ -47,8 +47,8 @@ . the element must also be updated for each new edition. . ///////////////////////////////////////////////////////////////////////////// -.set previousversion "4.69" -.set version "4.70" +.set previousversion "4.71" +.set version "4.72" .set ACL "access control lists (ACLs)" .set I "    " @@ -172,15 +172,13 @@ Specification of the Exim Mail Transfer Agent The Exim MTA -09 June 2009 -PhilipHazel -PH -University of Cambridge Computing Service -
New Museums Site, Pembroke Street, Cambridge CB2 3QH, England
+29 May 2010 +EximMaintainers +EM - 4.70 - 10 June 2009 - PH + 4.72 + 29 May 2010 + EM 2009University of Cambridge @@ -6138,7 +6136,7 @@ IPv6 addresses must be enclosed in quotes to prevent the first internal colon being interpreted as a key terminator. For example: .code 1.2.3.4: data for 1.2.3.4 -192.168.0.0/16 data for 192.168.0.0/16 +192.168.0.0/16: data for 192.168.0.0/16 "abcd::cdab": data for abcd::cdab "abcd:abcd::/32" data for abcd:abcd::/32 .endd @@ -6630,6 +6628,20 @@ ${lookup dnsdb{>: a=host1.example}} It is permitted to specify a space as the separator character. Further white space is ignored. +.new +.cindex "TXT record" "in &(dnsdb)& lookup" +For TXT records with multiple items of data, only the first item is returned, +unless a separator for them is specified using a comma after the separator +character followed immediately by the TXT record item separator. To concatenate +items without a separator, use a semicolon instead. +.code +${lookup dnsdb{>\n,: txt=a.b.example}} +${lookup dnsdb{>\n; txt=a.b.example}} +.endd +It is permitted to specify a space as the separator character. Further +white space is ignored. +.wen + .section "Pseudo dnsdb record types" "SECID66" .cindex "MX record" "in &(dnsdb)& lookup" By default, both the preference value and the host name are returned for @@ -9581,6 +9593,17 @@ For single-key lookup types, no quoting is ever necessary and this operator yields an unchanged string. +.vitem &*${randint:*&<&'n'&>&*}*& +.cindex "random number" +This operator returns a somewhat random number which is less than the +supplied number and is at least 0. The quality of this randomness depends +on how Exim was built; the values are not suitable for keying material. +If Exim is linked against OpenSSL then RAND_pseudo_bytes() is used. +Otherwise, the implementation may be arc4random(), random() seeded by +srandomdev() or srandom(), or a custom implementation even weaker than +random(). + + .vitem &*${rfc2047:*&<&'string'&>&*}*& .cindex "expansion" "RFC 2047" .cindex "RFC 2047" "expansion operator" @@ -11000,7 +11023,7 @@ precise size of the file that has been written. See also &$message_body_size$&, &$body_linecount$&, and &$body_zerocount$&. .cindex "RCPT" "value of &$message_size$&" -While running an ACL at the time of an SMTP RCPT command, &$message_size$& +While running a per message ACL (mail/rcpt/predata), &$message_size$& contains the size supplied on the MAIL command, or -1 if no size was given. The value may not, of course, be truthful. @@ -12369,6 +12392,7 @@ listed in more than one group. .row &%gnutls_require_mac%& "control GnuTLS MAC algorithms" .row &%gnutls_require_protocols%& "control GnuTLS protocols" .row &%gnutls_compat_mode%& "use GnuTLS compatibility mode" +.row &%openssl_options%& "adjust OpenSSL compatibility options" .row &%tls_advertise_hosts%& "advertise TLS to these hosts" .row &%tls_certificate%& "location of server certificate" .row &%tls_crl%& "certificate revocation list" @@ -13373,7 +13397,6 @@ This option controls whether GnuTLS is used in compatibility mode in an Exim server. This reduces security slightly, but improves interworking with older implementations of TLS. - .option headers_charset main string "see below" This option sets a default character set for translating from encoded MIME &"words"& in header lines, when referenced by an &$h_xxx$& expansion item. The @@ -13444,10 +13467,10 @@ do. By default, Exim just checks the syntax of HELO and EHLO commands (see &%helo_accept_junk_hosts%& and &%helo_allow_chars%&). However, some sites like to do more extensive checking of the data supplied by these commands. The ACL -condition &`verify`& &`=`& &`helo`& is provided to make this possible. +condition &`verify = helo`& is provided to make this possible. Formerly, it was necessary also to set this option (&%helo_try_verify_hosts%&) to force the check to occur. From release 4.53 onwards, this is no longer -necessary. If the check has not been done before &`verify`& &`=`& &`helo`& is +necessary. If the check has not been done before &`verify = helo`& is encountered, it is done at that time. Consequently, this option is obsolete. Its specification is retained here for backwards compatibility. @@ -13469,7 +13492,7 @@ available) yields the calling host address. However, the EHLO or HELO command is not rejected if any of the checks fail. Processing continues, but the result of the check is remembered, and can -be detected later in an ACL by the &`verify`& &`=`& &`helo`& condition. +be detected later in an ACL by the &`verify = helo`& condition. .option helo_verify_hosts main "host list&!!" unset .cindex "HELO verifying" "mandatory" @@ -13525,8 +13548,8 @@ this check fails, Exim behaves as if the name lookup failed. .vindex "&$sender_host_name$&" After any kind of failure, the host name (in &$sender_host_name$&) remains unset, and &$host_lookup_failed$& is set to the string &"1"&. See also -&%dns_again_means_nonexist%&, &%helo_lookup_domains%&, and &`verify`& &`=`& -&`reverse_host_lookup`& in ACLs. +&%dns_again_means_nonexist%&, &%helo_lookup_domains%&, and +&`verify = reverse_host_lookup`& in ACLs. .option host_lookup_order main "string list" &`bydns:byaddr`& @@ -13981,6 +14004,36 @@ harm. This option overrides the &%pipe_as_creator%& option of the &(pipe)& transport driver. +.option openssl_options main "string list" +dont_insert_empty_fragments +.cindex "OpenSSL "compatibility options" +This option allows an administrator to adjust the SSL options applied +by OpenSSL to connections. It is given as a space-separated list of items, +each one to be +added or -subtracted from the current value. The default +value is one option which happens to have been set historically. You can +remove all options with: +.code +openssl_options = -all +.endd +This option is only available if Exim is built against OpenSSL. The values +available for this option vary according to the age of your OpenSSL install. +The &"all"& value controls a subset of flags which are available, typically +the bug workaround options. The &'SSL_CTX_set_options'& man page will +list the values known on your system and Exim should support all the +&"bug workaround"& options and many of the &"modifying"& options. The Exim +names lose the leading &"SSL_OP_"& and are lower-cased. + +Note that adjusting the options can have severe impact upon the security of +SSL as used by Exim. It is possible to disable safety checks and shoot +yourself in the foot in various unpleasant ways. This option should not be +adjusted lightly. An unrecognised item will be detected at by invoking Exim +with the &%-bV%& flag. + +An example: +.code +openssl_options = -all +microsoft_big_sslv3_buffer +.endd + + .option oracle_servers main "string list" unset .cindex "Oracle" "server list" This option provides a list of Oracle servers and associated connection data, @@ -17846,10 +17899,10 @@ redirection items of the form :defer: :fail: .endd -respectively. When a redirection list contains such an item, it applies to the -entire redirection; any other items in the list are ignored (&':blackhole:'& is -different). Any text following &':fail:'& or &':defer:'& is placed in the error -text associated with the failure. For example, an alias file might contain: +respectively. When a redirection list contains such an item, it applies +to the entire redirection; any other items in the list are ignored. Any +text following &':fail:'& or &':defer:'& is placed in the error text +associated with the failure. For example, an alias file might contain: .code X.Employee: :fail: Gone away, no forwarding address .endd @@ -21022,6 +21075,17 @@ sought in the PATH directories, in the usual way. &*Warning*&: This does not apply to a command specified as a transport filter. +.option permit_coredump pipe boolean false +Normally Exim inhibits core-dumps during delivery. If you have a need to get +a core-dump of a pipe command, enable this command. This enables core-dumps +during delivery and affects both the Exim binary and the pipe command run. +It is recommended that this option remain off unless and until you have a need +for it and that this only be enabled when needed, as the risk of excessive +resource consumption can be quite high. Note also that Exim is typically +installed as a setuid binary and most operating systems will inhibit coredumps +of these by default, so further OS-specific action may be required. + + .option pipe_as_creator pipe boolean false .cindex "uid (user id)" "local delivery" If the generic &%user%& option is not set and this option is true, the delivery @@ -21162,6 +21226,7 @@ procmail_pipe: envelope_to_add check_string = "From " escape_string = ">From " + umask = 077 user = $local_part group = mail @@ -21461,19 +21526,19 @@ being used, names are looked up using &[gethostbyname()]& instead of using the DNS. Of course, that function may in fact use the DNS, but it may also consult other sources of information such as &_/etc/hosts_&. -.option gnutls_require_kx main string unset +.option gnutls_require_kx smtp string unset This option controls the key exchange mechanisms when GnuTLS is used in an Exim client. For details, see section &<>&. -.option gnutls_require_mac main string unset +.option gnutls_require_mac smtp string unset This option controls the MAC algorithms when GnuTLS is used in an Exim client. For details, see section &<>&. -.option gnutls_require_protocols main string unset +.option gnutls_require_protocols smtp string unset This option controls the protocols when GnuTLS is used in an Exim client. For details, see section &<>&. -.option gnutls_compat_mode main boolean unset +.option gnutls_compat_mode smtp boolean unset This option controls whether GnuTLS is used in compatibility mode in an Exim server. This reduces security slightly, but improves interworking with older implementations of TLS. @@ -23579,7 +23644,6 @@ the password conform to the Exim syntax. At the LDAP level, the password is an uninterpreted string. - .section "Support for different kinds of authentication" "SECID174" A number of string expansion features are provided for the purpose of interfacing to different ways of user authentication. These include checking @@ -24454,13 +24518,10 @@ unencrypted. The &%tls_certificate%& and &%tls_privatekey%& options of the &(smtp)& transport provide the client with a certificate, which is passed to the server if it requests it. If the server is Exim, it will request a certificate only if -&%tls_verify_hosts%& or &%tls_try_verify_hosts%& matches the client. &*Note*&: -These options must be set in the &(smtp)& transport for Exim to use TLS when it -is operating as a client. Exim does not assume that a server certificate (set -by the global options of the same name) should also be used when operating as a -client. +&%tls_verify_hosts%& or &%tls_try_verify_hosts%& matches the client. -If &%tls_verify_certificates%& is set, it must name a file or, +If the &%tls_verify_certificates%& option is set on the &(smtp)& transport, it +must name a file or, for OpenSSL only (not GnuTLS), a directory, that contains a collection of expected server certificates. The client verifies the server's certificate against this collection, taking into account any revoked certificates that are @@ -24472,6 +24533,12 @@ list of permitted cipher suites. If either of these checks fails, delivery to the current host is abandoned, and the &(smtp)& transport tries to deliver to alternative hosts, if any. + &*Note*&: +These options must be set in the &(smtp)& transport for Exim to use TLS when it +is operating as a client. Exim does not assume that a server certificate (set +by the global options of the same name) should also be used when operating as a +client. + .vindex "&$host$&" .vindex "&$host_address$&" All the TLS options in the &(smtp)& transport are expanded before use, with @@ -24806,7 +24873,6 @@ client are given temporary error responses until QUIT is received or the connection is closed. In these special cases, the QUIT ACL does not run. - .section "The not-QUIT ACL" "SECTNOTQUITACL" .vindex &$acl_smtp_notquit$& The not-QUIT ACL, specified by &%acl_smtp_notquit%&, is run in most cases when @@ -25807,7 +25873,7 @@ This control is permitted only for the MAIL, RCPT, and start of data ACLs (the latter is the one defined by &%acl_smtp_predata%&). Setting it tells Exim that the current message is a submission from a local MUA. In this case, Exim operates in &"submission mode"&, and applies certain fixups to the message if -necessary. For example, it add a &'Date:'& header line if one is not present. +necessary. For example, it adds a &'Date:'& header line if one is not present. This control is not permitted in the &%acl_smtp_data%& ACL, because that is too late (the message has already been created). @@ -25820,7 +25886,7 @@ that may be received in the same SMTP connection. .vitem &*control&~=&~suppress_local_fixups*& .cindex "submission fixups, suppressing" This control applies to locally submitted (non TCP/IP) messages, and is the -complement of &`control`& &`=`& &`submission`&. It disables the fixups that are +complement of &`control = submission`&. It disables the fixups that are normally applied to locally-submitted messages. Specifically: .ilist @@ -25849,12 +25915,12 @@ All four possibilities for message fixups can be specified: .ilist Locally submitted, fixups applied: the default. .next -Locally submitted, no fixups applied: use &`control`& &`=`& -&`suppress_local_fixups`&. +Locally submitted, no fixups applied: use +&`control = suppress_local_fixups`&. .next Remotely submitted, no fixups applied: the default. .next -Remotely submitted, fixups applied: use &`control`& &`=`& &`submission`&. +Remotely submitted, fixups applied: use &`control = submission`&. .endlist @@ -27000,7 +27066,7 @@ entry must set the rate for the same key (otherwise it will always be zero). For example: .code acl_check_connect: - deny ratelimit = 100 / 5m / strict / noupdate + deny ratelimit = 100 / 5m / strict / per_cmd / noupdate log_message = RATE: $sender_rate/$sender_rate_period \ (max $sender_rate_limit) .endd @@ -30298,8 +30364,8 @@ If a message contains a number of different addresses, all those with the same characteristics (for example, the same envelope sender) that resolve to the same set of hosts, in the same order, are sent in a single SMTP transaction, even if they are for different domains, unless there are more than the setting -of the &%max_rcpts%& option in the &(smtp)& transport allows, in which case -they are split into groups containing no more than &%max_rcpts%& addresses +of the &%max_rcpt%&s option in the &(smtp)& transport allows, in which case +they are split into groups containing no more than &%max_rcpt%&s addresses each. If &%remote_max_parallel%& is greater than one, such groups may be sent in parallel sessions. The order of hosts with identical MX values is not significant when checking whether addresses can be batched in this way. @@ -34568,7 +34634,6 @@ see the documentation of the &%$dkim_verify_status%& expansion variable above for more information of what they mean. .endlist - . //////////////////////////////////////////////////////////////////////////// . ////////////////////////////////////////////////////////////////////////////