X-Git-Url: https://git.exim.org/users/jgh/exim.git/blobdiff_plain/f8b168d7f3adb9088f63f75a191d04ecd1f6b1eb..6ae08012cf21a8e168bc8e89f56e43c96604da2c:/doc/doc-docbook/spec.xfpt diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index 2d29b17c8..8b2bb4dab 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -1575,7 +1575,7 @@ If a host is unreachable for a period of time, a number of messages may be waiting for it by the time it recovers, and sending them in a single SMTP connection is clearly beneficial. Whenever a delivery to a remote host is deferred, -.cindex "hints database" +.cindex "hints database" "deferred deliveries" Exim makes a note in its hints database, and whenever a successful SMTP delivery has happened, it looks to see if any other messages are waiting for the same host. If any are found, they are sent over the same SMTP @@ -1860,7 +1860,7 @@ described RFC 2047. This makes it possible to transmit characters that are not in the ASCII character set, and to label them as being in a particular character set. When Exim is inspecting header lines by means of the &%$h_%& mechanism, it decodes them, and translates them into a specified character set -(default ISO-8859-1). The translation is possible only if the operating system +(default is set at build time). The translation is possible only if the operating system supports the &[iconv()]& function. However, some of the operating systems that supply &[iconv()]& do not support @@ -3107,8 +3107,12 @@ users, the output is as in this example: .code mysql_servers = .endd -If &%configure_file%& is given as an argument, the name of the run time -configuration file is output. +If &%config%& is given as an argument, the config is +output, as it was parsed, any include file resolved, any comment removed. + +If &%config_file%& is given as an argument, the name of the run time +configuration file is output. (&%configure_file%& works too, for +backward compatibility.) If a list of configuration files was supplied, the value that is output here is the name of the file that was actually used. @@ -3548,6 +3552,9 @@ example: exim '-D ABC = something' ... .endd &%-D%& may be repeated up to 10 times on a command line. +.new +Only macro names up to 22 letters long can be set. +.wen .vitem &%-d%&<&'debug&~options'&> @@ -4800,8 +4807,8 @@ help with this. See the comments in &_src/EDITME_& for details. Exim's configuration file is divided into a number of different parts. General option settings must always appear at the start of the file. The other parts are all optional, and may appear in any order. Each part other than the first -is introduced by the word &"begin"& followed by the name of the part. The -optional parts are: +is introduced by the word &"begin"& followed by at least one literal +space, and the name of the part. The optional parts are: .ilist &'ACL'&: Access control lists for controlling incoming SMTP mail (see chapter @@ -6993,6 +7000,15 @@ Retries for the dnsdb lookup can be controlled by a retry modifier. The form if &"retry_VAL"& where VAL is an integer. The default count is set by the main configuration option &%dns_retry%&. +.new +.cindex cacheing "of dns lookup" +.cindex TTL "of dns lookup" +.cindex DNS TTL +Dnsdb lookup results are cached within a single process (and its children). +The cache entry lifetime is limited to the smallest time-to-live (TTL) +value of the set of returned DNS records. +.wen + .section "Pseudo dnsdb record types" "SECID66" .cindex "MX record" "in &(dnsdb)& lookup" @@ -7298,6 +7314,8 @@ The value of the DEREFERENCE parameter must be one of the words &"never"&, must be &"follow"& (the default) or &"nofollow"&. The latter stops the LDAP library from trying to follow referrals issued by the LDAP server. +.cindex LDAP timeout +.cindex timeout "LDAP lookup" The name CONNECT is an obsolete name for NETTIME, retained for backwards compatibility. This timeout (specified as a number of seconds) is enforced from the client end for operations that can be carried out over a @@ -7312,7 +7330,7 @@ The TIME parameter (also a number of seconds) is passed to the server to set a server-side limit on the time taken to complete a search. The SERVERS parameter allows you to specify an alternate list of ldap servers -to use for an individual lookup. The global ldap_servers option provides a +to use for an individual lookup. The global &%ldap_default_servers%& option provides a default list of ldap servers, and a single lookup can specify a single ldap server to use. But when you need to do a lookup with a list of servers that is different than the default list (maybe different order, maybe a completely @@ -7372,7 +7390,7 @@ SMTP authentication. See the &%ldapauth%& expansion string condition in chapter The &(ldapdn)& lookup type returns the Distinguished Name from a single entry as a sequence of values, for example .code -cn=manager, o=University of Cambridge, c=UK +cn=manager,o=University of Cambridge,c=UK .endd The &(ldap)& lookup type generates an error if more than one entry matches the search filter, whereas &(ldapm)& permits this case, and inserts a newline in @@ -7383,7 +7401,8 @@ directory. In the common case where you specify a single attribute in your LDAP query, the result is not quoted, and does not contain the attribute name. If the attribute -has multiple values, they are separated by commas. +has multiple values, they are separated by commas. Any comma that is +part of an attribute's value is doubled. If you specify multiple attributes, the result contains space-separated, quoted strings, each preceded by the attribute name and an equals sign. Within the @@ -7398,7 +7417,9 @@ same as specifying all of an entry's attributes. Here are some examples of the output format. The first line of each pair is an LDAP query, and the second is the data that is returned. The attribute called &%attr1%& has two values, one of them with an embedded comma, whereas -&%attr2%& has only one value: +&%attr2%& has only one value. Both attributes are derived from &%attr%& +(they have SUP &%attr%& in their schema definitions). + .code ldap:///o=base?attr1?sub?(uid=fred) value1.1,value1,,2 @@ -7406,6 +7427,9 @@ value1.1,value1,,2 ldap:///o=base?attr2?sub?(uid=fred) value two +ldap:///o=base?attr?sub?(uid=fred) +value1.1,value1,,2,value two + ldap:///o=base?attr1,attr2?sub?(uid=fred) attr1="value1.1,value1,,2" attr2="value two" @@ -7528,13 +7552,12 @@ a query is successfully processed. The result of a query may be that no data is found, but that is still a successful query. In other words, the list of servers provides a backup facility, not a list of different places to look. +.new The &%quote_mysql%&, &%quote_pgsql%&, and &%quote_oracle%& expansion operators convert newline, tab, carriage return, and backspace to \n, \t, \r, and \b respectively, and the characters single-quote, double-quote, and backslash -itself are escaped with backslashes. The &%quote_pgsql%& expansion operator, in -addition, escapes the percent and underscore characters. This cannot be done -for MySQL because these escapes are not recognized in contexts where these -characters are not special. +itself are escaped with backslashes. +.wen .section "Specifying the server in the query" "SECTspeserque" For MySQL and PostgreSQL lookups (but not currently for Oracle and InterBase), @@ -7580,13 +7603,17 @@ ${lookup pgsql{servers=master/db/name/pw; UPDATE ...} } .section "Special MySQL features" "SECID73" For MySQL, an empty host name or the use of &"localhost"& in &%mysql_servers%& causes a connection to the server on the local host by means of a Unix domain -socket. An alternate socket can be specified in parentheses. The full syntax of -each item in &%mysql_servers%& is: +socket. An alternate socket can be specified in parentheses. +.new +An option group name for MySQL option files can be specified in square brackets; +the default value is &"exim"&. +.wen +The full syntax of each item in &%mysql_servers%& is: .display -<&'hostname'&>::<&'port'&>(<&'socket name'&>)/<&'database'&>/&&& - <&'user'&>/<&'password'&> +<&'hostname'&>::<&'port'&>(<&'socket name'&>)[<&'option group'&>]/&&& + <&'database'&>/<&'user'&>/<&'password'&> .endd -Any of the three sub-parts of the first field can be omitted. For normal use on +Any of the four sub-parts of the first field can be omitted. For normal use on the local host it can be left blank or set to just &"localhost"&. No database need be supplied &-- but if it is absent here, it must be given in @@ -7638,6 +7665,8 @@ domainlist relay_to_domains = sqlite;/some/thing/sqlitedb \ The only character affected by the &%quote_sqlite%& operator is a single quote, which it doubles. +.cindex timeout SQLite +.cindex sqlite "lookup timeout" The SQLite library handles multiple simultaneous accesses to the database internally. Multiple readers are permitted, but only one process can update at once. Attempts to access the database while it is being updated @@ -9390,7 +9419,7 @@ yields &"42"&, and .code ${listextract{-3}{<, x,42,99,& Mailer,,/bin/bash}{result: $value}} .endd -yields &"result: 99"&. +yields &"result: 42"&. If {<&'string3'&>} is omitted, an empty string is used for string3. If {<&'string2'&>} is also omitted, the value that was @@ -10099,6 +10128,27 @@ as is, and other byte values are converted to &`\xNN`&, for example a byte value 127 is converted to &`\x7f`&. +.new +.vitem &*${ipv6denorm:*&<&'string'&>&*}*& +.cindex "&%ipv6denorm%& expansion item" +.cindex "IP address" normalisation +This expands an IPv6 address to a full eight-element colon-separated set +of hex digits including leading zeroes. +A trailing ipv4-style dotted-decimal set is converted to hex. +Pure IPv4 addresses are converted to IPv4-mapped IPv6. + +.vitem &*${ipv6norm:*&<&'string'&>&*}*& +.cindex "&%ipv6norm%& expansion item" +.cindex "IP address" normalisation +.cindex "IP address" "canonical form" +This converts an IPv6 address to canonical form. +Leading zeroes of groups are omitted, and the longest +set of zero-valued groups is replaced with a double colon. +A trailing ipv4-style dotted-decimal set is converted to hex. +Pure IPv4 addresses are converted to IPv4-mapped IPv6. +.wen + + .vitem &*${lc:*&<&'string'&>&*}*& .cindex "case forcing in strings" .cindex "string" "case forcing" @@ -10282,7 +10332,7 @@ f.7.2.0.0.0.0.c.d.c.b.a.1.0.0.0.9.0.0.0.2.4.c.0.8.b.d.0.1.0.0.2 This operator encodes text according to the rules of RFC 2047. This is an encoding that is used in header lines to encode non-ASCII characters. It is assumed that the input string is in the encoding specified by the -&%headers_charset%& option, which defaults to ISO-8859-1. If the string +&%headers_charset%& option, which gets its default at build time. If the string contains only characters in the range 33&--126, and no instances of the characters .code @@ -11110,7 +11160,8 @@ support for TLS or the content scanning extension. When a &%match%& expansion condition succeeds, these variables contain the captured substrings identified by the regular expression during subsequent processing of the success string of the containing &%if%& expansion item. -However, they do not retain their values afterwards; in fact, their previous +In the expansion condition case +they do not retain their values afterwards; in fact, their previous values are restored at the end of processing an &%if%& item. The numerical variables may also be set externally by some other matching process which precedes the expansion of the string. For example, the commands available in @@ -11318,9 +11369,10 @@ not the same as the user id of the originator of a message (see &$originator_uid$&). If Exim re-execs itself, this variable in the new incarnation normally contains the Exim uid. -.vitem &$compile_date$& -.vindex "&$compile_date$&" -The date on which the Exim binary was compiled. +.vitem &$callout_address$& +.vindex "&$callout_address$&" +After a callout for verification, spamd or malware daemon service, the +address that was connected to. .vitem &$compile_number$& .vindex "&$compile_number$&" @@ -11369,7 +11421,8 @@ see section &<>&. &$dkim_key_nosubdomains$& &&& &$dkim_key_srvtype$& &&& &$dkim_key_granularity$& &&& - &$dkim_key_notes$& + &$dkim_key_notes$& &&& + &$dkim_key_length$& These variables are only available within the DKIM ACL. For details see chapter &<>&. @@ -11979,6 +12032,13 @@ a single-component name, Exim calls &[gethostbyname()]& (or qualified host name. See also &$smtp_active_hostname$&. +.new +.vitem &$prdr_requested$& +.cindex "PRDR" "variable for" +This variable is set to &"yes"& if PRDR was requested by the client for the +current message, otherwise &"no"&. +.wen + .vitem &$prvscheck_address$& This variable is used in conjunction with the &%prvscheck%& expansion item, which is described in sections &<>& and @@ -12157,6 +12217,12 @@ increases for each accepted recipient. It can be referenced in an ACL. This variable is set to contain the matching regular expression after a &%regex%& ACL condition has matched (see section &<>&). +.vitem "&$regex1$&, &$regex2$&, etc" +.cindex "regex submatch variables (&$1regex$& &$2regex$& etc)" +When a &%regex%& or &%mime_regex%& ACL condition succeeds, +these variables contain the +captured substrings identified by the regular expression. + .vitem &$reply_address$& .vindex "&$reply_address$&" @@ -14460,7 +14526,7 @@ routing, but which are not used for listening by the daemon. See section . Allow this long option name to split; give it unsplit as a fifth argument . for the automatic .oindex that is generated by .option. -.option "extract_addresses_remove_ &~&~arguments" main boolean true &&& +.option "extract_addresses_remove_arguments" main boolean true &&& extract_addresses_remove_arguments .oindex "&%-t%&" .cindex "command line" "addresses with &%-t%&" @@ -16535,7 +16601,9 @@ runs. This is appropriate behaviour for obtaining wall-clock time on some, but unfortunately not all, operating systems. -.option tls_advertise_hosts main "host list&!!" unset +.new +.option tls_advertise_hosts main "host list&!!" * +.wen .cindex "TLS" "advertising" .cindex "encryption" "on SMTP connection" .cindex "SMTP" "encrypted connection" @@ -16543,6 +16611,11 @@ When Exim is built with support for TLS encrypted connections, the availability of the STARTTLS command to set up an encrypted session is advertised in response to EHLO only to those client hosts that match this option. See chapter &<>& for details of Exim's support for TLS. +.new +Note that the default value requires that a certificate be supplied +using the &%tls_certificate%& option. If no certificate is available then +the &%tls_advertise_hosts%& option should be set empty. +.wen .option tls_certificate main string&!! unset @@ -20522,6 +20595,32 @@ transport, the &[initgroups()]& function is called when running the transport to ensure that any additional groups associated with the uid are set up. +.new +.option max_parallel transports integer&!! unset +.cindex limit "transport parallelism" +.cindex transport "parallel processes" +.cindex transport "concurrency limit" +.cindex "delivery" "parallelism for transport" +If this option is set and expands to an integer greater than zero +it limits the number of concurrent runs of the transport. +The control does not apply to shadow transports. + +.cindex "hints database" "transport concurrency control" +Exim implements this control by means of a hints database in which a record is +incremented whenever a transport process is beaing created. The record +is decremented and possibly removed when the process terminates. +Obviously there is scope for +records to get left lying around if there is a system or program crash. To +guard against this, Exim ignores any records that are more than six hours old. + +If you use this option, you should also arrange to delete the +relevant hints database whenever your system reboots. The names of the files +start with &_misc_& and they are kept in the &_spool/db_& directory. There +may be one or two files, depending on the type of DBM in use. The same files +are used for ETRN and smtp transport serialization. +.wen + + .option message_size_limit transports string&!! 0 .cindex "limit" "message size per transport" .cindex "size" "of message, limit" @@ -20668,6 +20767,9 @@ headers that some sites insist on. This option sets up a filtering (in the Unix shell sense) process for messages at transport time. It should not be confused with mail filtering as set up by individual users or via a system filter. +.new +If unset, or expanding to an empty string, no filtering is done. +.wen When the message is about to be written out, the command specified by &%transport_filter%& is started up in a separate, parallel process, and @@ -22419,6 +22521,10 @@ If two messages arrive at almost the same time, and both are routed to a pipe delivery, the two pipe transports may be run concurrently. You must ensure that any pipe commands you set up are robust against this happening. If the commands write to a file, the &%exim_lock%& utility might be of use. +.new +Alternatively the &%max_parallel%& option could be used with a value +of "1" to enforce serialization. +.wen @@ -23601,6 +23707,10 @@ start with &_misc_& and they are kept in the &_spool/db_& directory. There may be one or two files, depending on the type of DBM in use. The same files are used for ETRN serialization. +.new +See also the &%max_parallel%& generic transport option. +.wen + .option size_addition smtp integer 1024 .cindex "SMTP" "SIZE" @@ -24252,7 +24362,7 @@ replaced, not just the working part. The replacement must be a complete RFC 2822 address, including the angle brackets if necessary. If text outside angle brackets contains a character whose value is greater than 126 or less than 32 (except for tab), the text is encoded according to RFC 2047. The character set -is taken from &%headers_charset%&, which defaults to ISO-8859-1. +is taken from &%headers_charset%&, which gets its default at build time. When the &"w"& flag is set on a rule that causes an envelope address to be rewritten, all but the working part of the replacement address is discarded. @@ -27343,8 +27453,12 @@ for some or all recipients. PRDR may be used to support per-user content filtering. Without it one must defer any recipient after the first that has a different content-filter configuration. With PRDR, the RCPT-time check -for this can be disabled when the MAIL-time $smtp_command included -"PRDR". Any required difference in behaviour of the main DATA-time +.new +.cindex "PRDR" "variable for" +for this can be disabled when the variable &$prdr_requested$& +is &"yes"&. +.wen +Any required difference in behaviour of the main DATA-time ACL should however depend on the PRDR-time ACL having run, as Exim will avoid doing so in some situations (e.g. single-recipient mails). @@ -29037,7 +29151,8 @@ This condition is relevant only in an ACL that is run after a message has been received, that is, in an ACL specified by &%acl_smtp_data%& or &%acl_not_smtp%&. It checks the syntax of all header lines that can contain lists of addresses (&'Sender:'&, &'From:'&, &'Reply-To:'&, &'To:'&, &'Cc:'&, -and &'Bcc:'&). Unqualified addresses (local parts without domains) are +and &'Bcc:'&), returning true if there are no problems. +Unqualified addresses (local parts without domains) are permitted only in locally generated messages and from hosts that match &%sender_unqualified_hosts%& or &%recipient_unqualified_hosts%&, as appropriate. @@ -29199,9 +29314,15 @@ deny dnslists = blackholes.mail-abuse.org warn message = X-Warn: sending host is on dialups list dnslists = dialups.mail-abuse.org .endd -DNS list lookups are cached by Exim for the duration of the SMTP session, +.cindex cacheing "of dns lookup" +.cindex DNS TTL +DNS list lookups are cached by Exim for the duration of the SMTP session +.new +(but limited by the DNS return TTL value), +.wen so a lookup based on the IP address is done at most once for any incoming -connection. Exim does not share information between multiple incoming +connection (assuming long-enough TTL). +Exim does not share information between multiple incoming connections (but your local name server cache should be active). @@ -30954,6 +31075,10 @@ malware = * / defer_ok / tmo=10s .endd A timeout causes the ACL to defer. +.vindex "&$callout_address$&" +When a connection is made to the scanner the expansion variable &$callout_address$& +is set to record the actual address used. + .vindex "&$malware_name$&" When a virus is found, the condition sets up an expansion variable called &$malware_name$& that contains the name of the virus. You can use it in a @@ -31065,7 +31190,7 @@ In the latter case, the range is tried in strict order. Elements after the first for Unix sockets, or second for TCP socket, are options. -The supported option are: +The supported options are: .code pri= Selection priority weight= Selection bias @@ -31104,6 +31229,10 @@ a dollar sign. In this case, the expansion may return a string that is used as the list so that multiple spamd servers can be the result of an expansion. +.vindex "&$callout_address$&" +When a connection is made to the server the expansion variable &$callout_address$& +is set to record the actual address used. + .section "Calling SpamAssassin from an Exim ACL" "SECID206" Here is a simple example of the use of the &%spam%& condition in a DATA ACL: .code @@ -31462,6 +31591,8 @@ deny message = contains blacklisted regex ($regex_match_string) The conditions returns true if any one of the regular expressions matches. The &$regex_match_string$& expansion variable is then set up and contains the matching regular expression. +The expansion variables &$regex1$& &$regex2$& etc +are set to any substrings captured by the regular expression. &*Warning*&: With large messages, these conditions can be fairly CPU-intensive. @@ -35080,7 +35211,7 @@ data when a message is received. See section &<>& below. .cindex "log" "delivery line" The format of the single-line entry in the main log that is written for every delivery is shown in one of the examples below, for local and remote -deliveries, respectively. Each example has been split into two lines in order +deliveries, respectively. Each example has been split into multiple lines in order to fit it on the page: .code 2002-10-31 08:59:13 16ZCW1-0005MB-00 => marv @@ -36231,6 +36362,9 @@ Serializing ETRN runs (when &%smtp_etrn_serialize%& is set) .next Serializing delivery to a specific host (when &%serialize_hosts%& is set in an &(smtp)& transport) +.next +Limiting the concurrency of specific transports (when &%max_parallel%& is set +in a transport) .endlist @@ -37833,6 +37967,8 @@ Key granularity (tag g=) from the key record. Defaults to "*" if not specified in the key record. .vitem &%$dkim_key_notes%& Notes from the key record (tag n=). +.vitem &%$dkim_key_length%& +Number of bits in the key. .endlist In addition, two ACL conditions are provided: