X-Git-Url: https://git.exim.org/users/jgh/exim.git/blobdiff_plain/fca41d5a245023376c7d7716a3f84abc2aaa4b8e..a713f9c58699e31cc76093c550dde2808563cd57:/doc/doc-txt/experimental-spec.txt?ds=inline diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt index 80e970cc1..aae8338f1 100644 --- a/doc/doc-txt/experimental-spec.txt +++ b/doc/doc-txt/experimental-spec.txt @@ -759,90 +759,103 @@ b. Configure, somewhere before the DATA ACL, the control option to -Transport post-delivery actions +Event Actions -------------------------------------------------------------- -An arbitrary per-transport string can be expanded on successful delivery, -and (for SMTP transports) a second string on deferrals caused by a host error. +(Renamed from TPDA, Transport post-delivery actions) + +An arbitrary per-transport string can be expanded upon various transport events. +Additionally a main-section configuration option can be expanded on some +per-message events. This feature may be used, for example, to write exim internal log information (not available otherwise) into a database. -In order to use the feature, you must set +In order to use the feature, you must compile with -EXPERIMENTAL_TPDA=yes +EXPERIMENTAL_EVENT=yes in your Local/Makefile -and define the expandable strings in the runtime config file, to -be executed at end of delivery. +and define one or both of +- the event_action option in the transport +- the event_action main option +to be expanded when the event fires. + +A new variable, $event_name, is set to the event type when the +expansion is done. The current list of events is: -Additionally, there are 6 more variables, available at end of -delivery: + msg:complete after main per message + msg:delivery after transport per recipient + msg:host:defer after transport per attempt + msg:fail:delivery after main per recipient + msg:fail:internal after main per recipient + tcp:connect before transport per connection + tcp:close after transport per connection + tls:cert before both per certificate in verification chain + smtp:connect after transport per connection -tpda_delivery_ip IP of host, which has accepted delivery -tpda_delivery_port Port of remote host which has accepted delivery -tpda_delivery_fqdn FQDN of host, which has accepted delivery -tpda_delivery_local_part local part of address being delivered -tpda_delivery_domain domain part of address being delivered -tpda_delivery_confirmation SMTP confirmation message +The expansion is called for all event types, and should use the $event_name +value to decide when to act. The variable data is a colon-separated +list, describing an event tree. -In case of a deferral caused by a host-error: -tpda_defer_errno Error number -tpda_defer_errstr Error string possibly containing more details +There is an auxilary variable, $event_data, for which the +content is event_dependent: -The $router_name and $transport_name variables are also usable. + msg:delivery smtp confirmation mssage + msg:host:defer error string + tls:cert verification chain depth + smtp:connect smtp banner +The msg:host:defer event populates one extra variable, $event_defer_errno. -To take action after successful deliveries, set the following option -on any transport of interest. +The following variables are likely to be useful depending on the event type: + + router_name, transport_name + local_part, domain + host, host_address, host_port + tls_out_peercert + lookup_dnssec_authenticated, tls_out_dane + sending_ip_address, sending_port + message_exim_id, verify_mode -tpda_delivery_action An example might look like: -tpda_delivery_action = \ -${lookup pgsql {SELECT * FROM record_Delivery( \ +event_action = ${if = {msg:delivery}{$event_name} \ +{${lookup pgsql {SELECT * FROM record_Delivery( \ '${quote_pgsql:$sender_address_domain}',\ '${quote_pgsql:${lc:$sender_address_local_part}}', \ - '${quote_pgsql:$tpda_delivery_domain}', \ - '${quote_pgsql:${lc:$tpda_delivery_local_part}}', \ - '${quote_pgsql:$tpda_delivery_ip}', \ - '${quote_pgsql:${lc:$tpda_delivery_fqdn}}', \ - '${quote_pgsql:$message_exim_id}')}} - -The string is expanded after the delivery completes and any -side-effects will happen. The result is then discarded. + '${quote_pgsql:$domain}', \ + '${quote_pgsql:${lc:$local_part}}', \ + '${quote_pgsql:$host_address}', \ + '${quote_pgsql:${lc:$host}}', \ + '${quote_pgsql:$message_exim_id}')}} \ +} {}} + +The string is expanded when each of the supported events occur +and any side-effects of the expansion will happen. Note that for complex operations an ACL expansion can be used. -In order to log host deferrals, add the following option to an SMTP -transport: +The expansion of the event_action option should normally +return an empty string. Should it return anything else the +following will be forced: -tpda_host_defer_action + msg:delivery (ignored) + msg:host:defer (ignored) + msg:fail:delivery (ignored) + tcp:connect do not connect + tcp:close (ignored) + tls:cert refuse verification + smtp:connect close connection -This is a private option of the SMTP transport. It is intended to -log failures of remote hosts. It is executed only when exim has -attempted to deliver a message to a remote host and failed due to -an error which doesn't seem to be related to the individual -message, sender, or recipient address. -See section 47.2 of the exim documentation for more details on how -this is determined. +No other use is made of the result string. -Example: -tpda_host_defer_action = \ -${lookup mysql {insert into delivlog set \ - msgid = '${quote_mysql:$message_exim_id}', \ - senderlp = '${quote_mysql:${lc:$sender_address_local_part}}', \ - senderdom = '${quote_mysql:$sender_address_domain}', \ - delivlp = '${quote_mysql:${lc:$tpda_delivery_local_part}}', \ - delivdom = '${quote_mysql:$tpda_delivery_domain}', \ - delivip = '${quote_mysql:$tpda_delivery_ip}', \ - delivport = '${quote_mysql:$tpda_delivery_port}', \ - delivfqdn = '${quote_mysql:$tpda_delivery_fqdn}', \ - deliverrno = '${quote_mysql:$tpda_defer_errno}', \ - deliverrstr = '${quote_mysql:$tpda_defer_errstr}' \ - }} +Known issues: +- the tls:cert event is only called for the cert chain elements + received over the wire, with GnuTLS. OpenSSL gives the entire + chain including thse loaded locally. Redis Lookup @@ -1071,82 +1084,6 @@ QUIT 221 mail.example.net closing connection -DSN Support --------------------------------------------------------------- - -DSN Support tries to add RFC 3461 support to Exim. It adds support for -*) the additional parameters for MAIL FROM and RCPT TO -*) RFC complient MIME DSN messages for all of - success, failure and delay notifications -*) dsn_advertise_hosts main option to select which hosts are able - to use the extension -*) dsn_lasthop router switch to end DSN processing - -In case of failure reports this means that the last three parts, the message body -intro, size info and final text, of the defined template are ignored since there is no -logical place to put them in the MIME message. - -All the other changes are made without changing any defaults - -Building exim: --------------- - -Define -EXPERIMENTAL_DSN=YES -in your Local/Makefile. - -Configuration: --------------- -All DSNs are sent in MIME format if you built exim with EXPERIMENTAL_DSN=YES -No option needed to activate it, and no way to turn it off. - -Failure and delay DSNs are triggered as usual except a sender used NOTIFY=... -to prevent them. - -Support for Success DSNs is added and activated by NOTIFY=SUCCESS by clients. - -Add -dsn_advertise_hosts = * -or a more restrictive host_list to announce DSN in EHLO answers - -Those hosts can then use NOTIFY,ENVID,RET,ORCPT options. - -If a message is relayed to a DSN aware host without changing the envelope -recipient the options are passed along and no success DSN is generated. - -A redirect router will always trigger a success DSN if requested and the DSN -options are not passed any further. - -A success DSN always contains the recipient address as submitted by the -client as required by RFC. Rewritten addresses are never exposed. - -If you used DSN patch up to 1.3 before remove all "dsn_process" switches from -your routers since you don't need them anymore. There is no way to "gag" -success DSNs anymore. Announcing DSN means answering as requested. - -You can prevent Exim from passing DSN options along to other DSN aware hosts by defining -dsn_lasthop -in a router. Exim will then send the success DSN himself if requested as if -the next hop does not support DSN. -Adding it to a redirect router makes no difference. - - -Certificate name checking --------------------------------------------------------------- -The X509 certificates used for TLS are supposed be verified -that they are owned by the expected host. The coding of TLS -support to date has not made these checks. - -If built with EXPERIMENTAL_CERTNAMES defined, code is -included to do so, and a new smtp transport option -"tls_verify_cert_hostname" supported which takes a list of -names for which the checks must be made. The host must -also be in "tls_verify_hosts". - -Both Subject and Subject-Alternate-Name certificate fields -are supported, as are wildcard certificates (limited to -a single wildcard being the initial component of a 3-or-more -component FQDN). DANE @@ -1171,6 +1108,10 @@ admins of the target server. The attack surface presented by (a) is thought to be smaller than that of the set of root CAs. +It also allows the server to declare (implicitly) that +connections to it should use TLS. An MITM could simply +fail to pass on a server's STARTTLS. + DANE scales better than having to maintain (and side-channel communicate) copies of server certificates for every possible target server. It also scales @@ -1195,12 +1136,12 @@ There are no changes to Exim specific to server-side operation of DANE. The TLSA record for the server may have "certificate -usage" of DANE_TA(2) or DANE_EE(3). The latter specifies +usage" of DANE-TA(2) or DANE-EE(3). The latter specifies the End Entity directly, i.e. the certificate involved is that of the server (and should be the sole one transmitted during the TLS handshake); this is appropriate for a single system, using a self-signed certificate. - DANE_TA usage is effectively declaring a specific CA + DANE-TA usage is effectively declaring a specific CA to be used; this might be a private CA or a public, well-known one. A private CA at simplest is just a self-signed certificate which is used to sign @@ -1212,7 +1153,7 @@ the entire certificate chain from CA to server-certificate. If a public CA is used then all clients must be primed with it (losing one advantage of DANE) - but the attack surface is reduced from all public CAs to that single CA. -DANE_TA is commonly used for several services and/or +DANE-TA is commonly used for several services and/or servers, each having a TLSA query-domain CNAME record, all of which point to a single TLSA record. @@ -1229,13 +1170,13 @@ is useful for quickly generating TLSA records; and commands like are workable for 4th-field hashes. -For use with the DANE_TA model, server certificates +For use with the DANE-TA model, server certificates must have a correct name (SubjectName or SubjectAltName). The use of OCSP-stapling should be considered, allowing for fast revocation of certificates (which would otherwise be limited by the DNS TTL on the TLSA records). However, -this is likely to only be usable with DANE_TA. NOTE: the +this is likely to only be usable with DANE-TA. NOTE: the default of requesting OCSP for all hosts is modified iff DANE is in use, to: @@ -1246,13 +1187,15 @@ DANE is in use, to: The (new) variable $tls_out_tlsa_usage is a bitfield with numbered bits set for TLSA record usage codes. The zero above means DANE was not in use, -the four means that only DANE_TA usage TLSA records were -found. If the definition of hosts_require_ocsp or -hosts_request_ocsp includes the string "tls_out_tlsa_usage", -they are re-expanded in time to control the OCSP request. +the four means that only DANE-TA usage TLSA records were +found. If the definition of hosts_request_ocsp includes the +string "tls_out_tlsa_usage", they are re-expanded in time to +control the OCSP request. This modification of hosts_request_ocsp is only done if -it has the default value of "*". +it has the default value of "*". Admins who change it, and +those who use hosts_require_ocsp, should consider the interaction +with DANE in their OCSP settings. For client-side DANE there are two new smtp transport options, @@ -1262,9 +1205,15 @@ hosts_try_dane and hosts_require_dane. They do the obvious thing. DANE will only be usable if the target host has DNSSEC-secured MX, A and TLSA records. +A TLSA lookup will be done if either of the above options match +and the host-lookup succeded using dnssec. +If the TLSA lookup succeeds, a TLS connection will be required +for the host. + (TODO: specify when fallback happens vs. when the host is not used) If dane is in use the following transport options are ignored: + hosts_require_tls tls_verify_hosts tls_try_verify_hosts tls_verify_certificates @@ -1279,7 +1228,7 @@ in the delivery log line will show as "CV=dane". There is a new variable $tls_out_dane which will have "yes" if verification succeeded using DANE and "no" otherwise (only useful -in combination with EXPERIMENTAL_TPDA), and a new variable +in combination with EXPERIMENTAL_EVENT), and a new variable $tls_out_tlsa_usage (detailed above).