(1) Checking for invalid "control=" modifiers was not working (for example,
[exim.git] / doc / doc-txt / NewStuff
35edf2ff 1$Cambridge: exim/doc/doc-txt/NewStuff,v 1.2 2004/10/18 09:16:57 ph10 Exp $
3New Features in Exim
6This file contains descriptions of new features that have been added to Exim,
7but have not yet made it into the main manual (which is most conveniently
8updated when there is a relatively large batch of changes). The doc/ChangeLog
9file contains a listing of all changes, including bug fixes.
12Version 4.44
15 1. There is a new build-time option called CONFIGURE_GROUP which works like
16 CONFIGURE_OWNER. It specifies one additional group that is permitted for
17 the runtime configuration file when the group write permission is set.
20Version 4.43
23 1. There is a new Boolean global option called mua_wrapper, defaulting false.
24 This causes Exim to run an a restricted mode, in order to provide a very
25 specific service.
27 Background: On a personal computer, it is a common requirement for all
28 email to be sent to a smarthost. There are plenty of MUAs that can be
29 configured to operate that way, for all the popular operating systems.
30 However, there are MUAs for Unix-like systems that cannot be so configured:
31 they submit messages using the command line interface of
32 /usr/sbin/sendmail. In addition, utility programs such as cron submit
33 messages this way.
35 Requirement: The requirement is for something that can provide the
36 /usr/sbin/sendmail interface and deliver messages to a smarthost, but not
37 provide any queueing or retrying facilities. Furthermore, the delivery to
38 the smarthost should be synchronous, so that if it fails, the sending MUA
39 is immediately informed. In other words, we want something that in effect
40 converts a command-line MUA into a TCP/SMTP MUA.
42 Solutions: There are a number of applications (for example, ssmtp) that do
43 this job. However, people have found them to be lacking in various ways.
44 For instance, some sites want to allow aliasing and forwarding before
45 sending to the smarthost.
47 Using Exim: Exim already had the necessary infrastructure for doing this
48 job. Just a few tweaks were needed to make it behave as required, though it
49 is somewhat of an overkill to use a fully-featured MTA for this purpose.
51 Setting mua_wrapper=true causes Exim to run in a special mode where it
52 assumes that it is being used to "wrap" a command-line MUA in the manner
53 just described.
55 If you set mua_wrapper=true, you also need to provide a compatible router
56 and transport configuration. Typically there will be just one router and
57 one transport, sending everything to a smarthost.
59 When run in MUA wrapping mode, the behaviour of Exim changes in the
60 following ways:
62 (a) A daemon cannot be run, nor will Exim accept incoming messages from
63 inetd. In other words, the only way to submit messages is via the
64 command line.
66 (b) Each message is synchonously delivered as soon as it is received (-odi
67 is assumed). All queueing options (queue_only, queue_smtp_domains,
68 control=queue, control=freeze in an ACL etc.) are quietly ignored. The
69 Exim reception process does not finish until the delivery attempt is
70 complete. If the delivery was successful, a zero return code is given.
72 (c) Address redirection is permitted, but the final routing for all
73 addresses must be to the same remote transport, and to the same list of
74 hosts. Furthermore, the return_address must be the same for all
75 recipients, as must any added or deleted header lines. In other words,
76 it must be possible to deliver the message in a single SMTP
77 transaction, however many recipients there are.
79 (d) If the conditions in (c) are not met, or if routing any address results
80 in a failure or defer status, or if Exim is unable to deliver all the
81 recipients successfully to one of the hosts immediately, delivery of
82 the entire message fails.
84 (e) Because no queueing is allowed, all failures are treated as permanent;
85 there is no distinction between 4xx and 5xx SMTP response codes from
86 the smarthost. Furthermore, because only a single yes/no response can
87 be given to the caller, it is not possible to deliver to some
88 recipients and not others. If there is an error (temporary or
89 permanent) for any recipient, all are failed.
91 (f) If more than one host is listed, Exim will try another host after a
92 connection failure or a timeout, in the normal way. However, if this
93 kind of failure happens for all the hosts, the delivery fails.
95 (g) When delivery fails, an error message is written to the standard error
96 stream (as well as to Exim's log), and Exim exits to the caller with a
97 return code value 1. The message is expunged from Exim's spool files.
98 No bounce messages are ever generated.
100 (h) No retry data is maintained, and any retry rules are ignored.
102 (i) A number of Exim options are overridden: deliver_drop_privilege is
103 forced true, max_rcpt in the smtp transport is forced to "unlimited",
104 remote_max_parallel is forced to one, and fallback hosts are ignored.
106 The overall effect is that Exim makes a single synchronous attempt to
107 deliver the message, failing if there is any kind of problem. Because no
108 local deliveries are done and no daemon can be run, Exim does not need root
109 privilege. It should be possible to run it setuid=exim instead of
110 setuid=root. See section 48.3 in the 4.40 manual for a general discussion
111 about the advantages and disadvantages of running without root privilege.
113 2. There have been problems with DNS servers when SRV records are looked up.
114 Some mis-behaving servers return a DNS error or timeout when a non-existent
115 SRV record is sought. Similar problems have in the past been reported for
116 MX records. The global dns_again_means_nonexist option can help with this
117 problem, but it is heavy-handed because it is a global option. There are
118 now two new options for the dnslookup router. They are called
119 srv_fail_domains and mx_fail_domains. In each case, the value is a domain
120 list. If an attempt to look up an SRV or MX record results in a DNS failure
121 or "try again" response, and the domain matches the relevant list, Exim
122 behaves as if the DNS had responded "no such record". In the case of an SRV
123 lookup, this means that the router proceeds to look for MX records; in the
124 case of an MX lookup, it proceeds to look for A or AAAA records, unless the
125 domain matches mx_domains.
127 3. The following functions are now available in the local_scan() API:
129 (a) void header_remove(int occurrence, uschar *name)
131 This function removes header lines. If "occurrence" is zero or negative,
132 all occurrences of the header are removed. If occurrence is greater
133 than zero, that particular instance of the header is removed. If no
134 header(s) can be found that match the specification, the function does
135 nothing.
137 (b) BOOL header_testname(header_line *hdr, uschar *name, int length,
138 BOOL notdel)
140 This function tests whether the given header has the given name. It
141 is not just a string comparison, because whitespace is permitted
142 between the name and the colon. If the "notdel" argument is TRUE, a
143 FALSE return is forced for all "deleted" headers; otherwise they are
144 not treated specially. For example:
146 if (header_testname(h, US"X-Spam", 6, TRUE)) ...
148 (c) void header_add_at_position(BOOL after, uschar *name, BOOL topnot,
149 int type, char *format, ...)
151 This function adds a new header line at a specified point in the header
152 chain. If "name" is NULL, the new header is added at the end of the
153 chain if "after" is TRUE, or at the start if "after" is FALSE. If
154 "name" is not NULL, the headers are searched for the first non-deleted
155 header that matches the name. If one is found, the new header is added
156 before it if "after" is FALSE. If "after" is true, the new header is
157 added after the found header and any adjacent subsequent ones with the
158 same name (even if marked "deleted"). If no matching non-deleted header
159 is found, the "topnot" option controls where the header is added. If it
160 is TRUE, addition is at the top; otherwise at the bottom. Thus, to add
161 a header after all the Received: headers, or at the top if there are no
162 Received: headers, you could use
164 header_add_at_position(TRUE, US"Received", TRUE, ' ', "X-xxx: ...");
166 Normally, there is always at least one non-deleted Received: header,
167 but there may not be if received_header_text expands to an empty
168 string.
170 (d) BOOL receive_remove_recipient(uschar *recipient)
172 This is a convenience function to remove a named recipient from the
173 list of recipients. It returns TRUE if a recipient was removed, and
174 FALSE if no matching recipient could be found. The argument must be a
175 complete email address.
177 4. When an ACL "warn" statement adds one or more header lines to a message,
178 they are added at the end of the existing header lines by default. It is
179 now possible to specify that any particular header line should be added
180 right at the start (before all the Received: lines) or immediately after
181 the first block of Received: lines in the message. This is done by
182 specifying :at_start: or :after_received: (or, for completeness, :at_end:)
183 before the text of the header line. (Header text cannot start with a colon,
184 as there has to be a header name first.) For example:
186 warn message = :after_received:X-My-Header: something or other...
188 If more than one header is supplied in a single warn statement, each one is
189 treated independently and can therefore be placed differently. If you add
190 more than one line at the start, or after the Received: block, they will
191 end up in reverse order.
193 Warning: This facility currently applies only to header lines that are
194 added in an ACL. It does NOT work for header lines that are added in a
195 system filter or in a router or transport.
197 5. There is now a new error code that can be used in retry rules. Its name is
198 "rcpt_4xx", and there are three forms. A literal "rcpt_4xx" matches any 4xx
199 error received for an outgoing SMTP RCPT command; alternatively, either the
200 first or both of the x's can be given as digits, for example: "rcpt_45x" or
201 "rcpt_436". If you want (say) to recognize 452 errors given to RCPT
202 commands by a particular host, and have only a one-hour retry for them, you
203 can set up a retry rule of this form:
205 the.host.name rcpt_452 F,1h,10m
207 Naturally, this rule must come before any others that would match.
209 These new errors apply to both outgoing SMTP (the smtp transport) and
210 outgoing LMTP (either the lmtp transport, or the smtp transport in LMTP
211 mode). Note, however, that they apply only to responses to RCPT commands.
213 6. The "postmaster" option of the callout feature of address verification has
214 been extended to make it possible to use a non-empty MAIL FROM address when
215 checking a postmaster address. The new suboption is called "postmaster_
216 mailfrom", and you use it like this:
218 require verify = sender/callout=postmaster_mailfrom=abc@x.y.z
220 Providing this suboption causes the postmaster check to be done using the
221 given address. The original "postmaster" option is equivalent to
223 require verify = sender/callout=postmaster_mailfrom=
225 If both suboptions are present, the rightmost one overrides.
227 Important notes:
229 (1) If you use a non-empty sender address for postmaster checking, there is
230 the likelihood that the remote host will itself initiate a callout
231 check back to your host to check that address. As this is a "normal"
232 callout check, the sender will most probably be empty, thus avoiding
233 possible callout loops. However, to be on the safe side it would be
234 best to set up your own ACLs so that they do not do sender verification
235 checks when the recipient is the address you use for postmaster callout
236 checking.
238 (2) The caching arrangements for postmaster checking do NOT take account of
239 the sender address. It is assumed that either the empty address, or a
240 fixed non-empty address will be used. All that Exim remembers is that
241 the postmaster check for the domain succeeded or failed.
243 7. When verifying addresses in header lines using the verify=header_sender
244 option, Exim behaves by default as if the addresses are envelope sender
245 addresses from a message. Callout verification therefore tests to see
246 whether a bounce message could be delivered, by using an empty address in
247 the MAIL FROM command. However, it is arguable that these addresses might
248 never be used as envelope senders, and could therefore justifiably reject
249 bounce messages (empty senders). There is now an additional callout option
250 for verify=header_sender that allows you to specify what address to use in
251 the MAIL FROM command. You use it as in this example:
253 require verify = header_sender/callout=mailfrom=abcd@x.y.z
255 Important notes:
257 (1) As in the case of postmaster_mailfrom (see above), you should think
258 about possible loops.
260 (2) In this case, as in the case of recipient callouts with non-empty
261 senders (the use_sender option), caching is done on the basis of a
262 recipient/sender pair.
264 8. If you build Exim with USE_READLINE=yes in Local/Makefile, it will try to
265 load libreadline dynamically whenever the -be (test expansion) option is
266 used without command line arguments. If successful, it will then use
267 readline() for reading the test data. A line history is supported. By the
268 time Exim does this, it is running as the calling user, so this should not
269 cause any security problems. Security is the reason why this is NOT
270 supported for -bt or -bv, when Exim is running as root or exim,
271 respectively. Note that this option adds to the size of the Exim binary,
272 because the dynamic loading library is not otherwise included. On my
273 desktop it adds about 2.5K. You may need to add -ldl to EXTRA_LIBS when you
274 set USE_READLINE=yes.
276 9. Added ${str2b64:<string>} to the expansion operators. This operator
277 converts an arbitrary string into one that is base64 encoded.
27910. A new authenticator, called cyrus_sasl, has been added. This requires
280 the presence of the Cyrus SASL library; it authenticates by calling this
281 library, which supports a number of authentication mechanisms, including
282 PLAIN and LOGIN, but also several others that Exim does not support
283 directly. The code for this authenticator was provided by Matthew
284 Byng-Maddick of A L Digital Ltd (http://www.aldigital.co.uk). Here follows
285 draft documentation:
289 The cyrus_sasl authenticator provides server support for the Cyrus library
290 Implementation of the RFC 2222 "Simple Authentication and Security Layer".
291 It provides a gatewaying mechanism directly to the Cyrus interface, so if
292 your Cyrus library can do, for example, CRAM-MD5, then so can the
293 cyrus_sasl authenticator. By default it uses the public name of the driver
294 to determine which mechanism to support.
296 Where access to some kind of secret file is required, for example in GSSAPI
297 or CRAM-MD5, it is worth noting that the authenticator runs as the exim
298 user, and that the Cyrus SASL library has no way of escalating privileges
299 by default. You may also find you need to set environment variables,
300 depending on the driver you are using.
302 xx.1 Using cyrus_sasl as a server
304 The cyrus_sasl authenticator has four private options. It puts the username
305 (on a successful authentication) into $1.
307 server_hostname Type: string* Default: $primary_hostname
309 This option selects the hostname that is used when communicating with
310 the library. It is up to the underlying SASL plug-in what it does with
311 this data.
313 server_mech Type: string Default: public_name
315 This option selects the authentication mechanism this driver should
316 use. It allows you to use a different underlying mechanism from the
317 advertised name. For example:
319 sasl:
320 driver = cyrus_sasl
321 public_name = X-ANYTHING
322 server_mech = CRAM-MD5
323 server_set_id = $1
325 server_realm Type: string Default: unset
327 This is the SASL realm that the server is claiming to be in.
329 server_service Type: string Default: "smtp"
331 This is the SASL service that the server claims to implement.
333 For straigthforward cases, you do not need to set any of the
334 authenticator's private options. All you need to do is to specify an
335 appropriate mechanism as the public name. Thus, if you have a SASL library
336 that supports CRAM-MD5 and PLAIN, you might have two authenticators as
337 follows:
339 sasl_cram_md5:
340 driver = cyrus_sasl
341 public_name = CRAM-MD5
342 server_set_id = $1
344 sasl_plain:
345 driver = cyrus_sasl
346 public_name = PLAIN
347 server_set_id = $1
34911. There is a new global option called tls_on_connect_ports. Its value must be
350 a list of port numbers; the most common use is expected to be
352 tls_on_connect_ports = 465
354 Setting this option has the same effect as -tls-on-connect on the command
355 line, but only for the specified ports. It applies to all connections, both
356 via the daemon and via inetd. You still need to specify all the ports for
357 the daemon (using daemon_smtp_ports or local_interfaces or the -X command
358 line option) because this option does not add an extra port -- rather, it
359 specifies different behaviour on a port that is defined elsewhere. The
360 -tls-on-connect command line option overrides tls_on_connect_ports, and
361 forces tls-on-connect for all ports.
36312. There is a new ACL that is run when a DATA command is received, before the
364 data itself is received. The ACL is defined by acl_smtp_predata. (Compare
365 acl_smtp_data, which is run after the data has been received.)
366 This new ACL allows a negative response to be given to the DATA command
367 itself. Header lines added by MAIL or RCPT ACLs are not visible at this
368 time, but any that are defined here are visible when the acl_smtp_data ACL
369 is run.
37113. The "control=submission" ACL modifier has an option "/domain=xxx" which
372 specifies the domain to be used when creating From: or Sender: lines using
373 the authenticated id as a local part. If the option is supplied with an
374 empty domain, that is, just "/domain=", Exim assumes that the authenticated
375 id is a complete email address, and it uses it as is when creating From:
376 or Sender: lines.
37814. It is now possible to make retry rules that apply only when the failing
379 message has a specific sender. In particular, this can be used to define
380 retry rules that apply only to bounce messages. The syntax is to add a new
381 third item to a retry rule, of the form "senders=<address list>". The retry
382 timings themselves then become the fourth item. For example:
384 * * senders=: F,1h,30m
386 would match all bounce messages. If the address list contains white space,
387 it must be enclosed in quotes. For example:
389 a.domain timeout senders="x@b.dom : y@c.dom" G,8h,10m,1.5
391 When testing retry rules using -brt, you can supply a sender using the -f
392 command line option, like this:
394 exim -f "" -brt user@dom.ain
396 If you do not set -f with -brt, a retry rule that contains a senders list
397 will never be matched.
39915. Two new control modifiers have been added to ACLs: "control = enforce_sync"
400 and "control = no_enforce_sync". This makes it possible to be selective
401 about when SMTP synchronization is enforced. The global option
402 smtp_enforce_sync now specifies the default state of the switch. These
403 controls can appear in any ACL, but the most obvious place to put them is
404 in the ACL defined by acl_smtp_connect, which is run at the start of an
405 incoming SMTP connection, before the first synchronization check.
40716. Another two new control modifiers are "control = caseful_local_part" and
408 "control = caselower_local_part". These are permitted only in the ACL
409 specified by acl_smtp_rcpt (i.e. during RCPT processing). By default, the
410 contents of $local_part are lower cased before ACL processing.
411 After "control = caseful_local_part", any uppercase letters in the original
412 local part are restored in $local_part for the rest of the ACL, or until
413 "control = caselower_local_part" is encountered. However, this applies only
414 to local part handling that takes place directly in the ACL (for example,
415 as a key in lookups). If a "verify = recipient" test is obeyed, the
416 case-related handling of the local part during the verification is
417 controlled by the router configuration (see the caseful_local_part generic
418 router option).
420 This facility could be used, for example, to add a spam score to local
421 parts containing upper case letters. For example, using $acl_m4 to
422 accumulate the spam score:
424 warn control = caseful_local_part
425 set acl_m4 = ${eval:\
426 $acl_m4 + \
427 ${if match{$local_part}{[A-Z]}{1}{0}}\
428 }
429 control = caselower_local_part
431 Notice that we put back the lower cased version afterwards, assuming that
432 is what is wanted for subsequent tests.
43417. The option hosts_connection_nolog is provided so that certain hosts can be
435 excepted from logging when the +smtp_connection log selector is set. For
436 example, you might want not to log SMTP connections from local processes,
437 or from, or from your local LAN. The option is a host list with
438 an unset default. Because it is consulted in the main loop of the daemon,
439 you should strive to restrict its value to a short inline list of IP
440 addresses and networks. To disable logging SMTP connections from local
441 processes, you must create a host list with an empty item. For example:
443 hosts_connection_nolog = :
445 If the +smtp_connection log selector is not set, this option has no effect.
44718. There is now an acl called acl_smtp_quit, which is run for the QUIT
448 command. The outcome of the ACL does not affect the response code to QUIT,
449 which is always 221. Thus, the ACL does not in fact control any access.
450 For this reason, the only verbs that are permitted are "accept" and "warn".
452 The ACL can be used for tasks such as custom logging at the end of an SMTP
453 session. For example, you can use ACL variables in other ACLs to count
454 messages, recipients, etc., and log the totals at QUIT time using one or
455 more "logwrite" modifiers on a "warn" command.
457 You do not need to have a final "accept", but if you do, you can use a
458 "message" modifier to specify custom text that is sent as part of the 221
459 response.
461 This ACL is run only for a "normal" QUIT. For certain kinds of disastrous
462 failure (for example, failure to open a log file, or when Exim is bombing
463 out because it has detected an unrecoverable error), all SMTP commands
464 from the client are given temporary error responses until QUIT is received
465 or the connection is closed. In these special cases, the ACL is not run.
46719. The appendfile transport has two new options, mailbox_size and mailbox_
468 filecount. If either these options are set, it is expanded, and the result
469 is taken as the current size of the mailbox or the number of files in the
470 mailbox, respectively. This makes it possible to use some external means of
471 maintaining the data about the size of a mailbox for enforcing quota
472 limits. The result of expanding these option values must be a decimal
473 number, optionally followed by "K" or "M".
47520. It seems that there are broken clients in use that cannot handle multiline
476 SMTP responses. Can't people who implement these braindead programs read?
477 RFC 821 mentions multiline responses, and it is over 20 years old. They
478 must handle multiline responses for EHLO, or do they still use HELO?
479 Anyway, here is YAWFAB (yet another workaround for asinine brokenness).
480 There's a new ACL switch that can be set by
482 control = no_multiline_responses
484 If this is set, it suppresses multiline SMTP responses from ACL rejections.
485 One way of doing this would have been just to put out these responses as
486 one long line. However, RFC 2821 specifies a maximum of 512 bytes per
487 response ("use multiline responses for more" it says), and some of the
488 responses might get close to that. So I have implemented this by doing two
489 very easy things:
491 (1) Extra information that is normally output as part of a rejection
492 caused by sender verification failure is omitted. Only the final line
493 (typically "sender verification failed") is now sent.
495 (2) If a "message" modifier supplies a multiline response, only the first
496 line is output.
498 The setting of the switch can, of course, be made conditional on the
499 calling host.
50121. There is now support for the libradius library that comes with FreeBSD.
502 This is an alternative to the radiusclient library that Exim already
503 supports. To use the FreeBSD library, you need to set
507 in Local/Makefile, in addition to RADIUS_CONFIGURE_FILE, and you probably
508 also need -libradius in EXTRALIBS.
511Version 4.42
514 1. The "personal" filter test is brought up-to-date with recommendations from
515 the Sieve specification: (a) The list of non-personal From: addresses now
516 includes "listserv", "majordomo", and "*-request"; (b) If the message
517 contains any header line starting with "List=-" it is treated as
518 non-personal.
520 2. The Sieve functionality has been extended to support the "copy" and
521 "vacation" extensions, and comparison tests.
523 3. There is now an overall timeout for performing a callout verification. It
524 defaults to 4 times the callout timeout, which applies to individual SMTP
525 commands during the callout. The overall timeout applies when there is more
526 than one host that can be tried. The timeout is checked before trying the
527 next host. This prevents very long delays if there are a large number of
528 hosts and all are timing out (e.g. when the network connections are timing
529 out). The value of the overall timeout can be changed by specifying an
530 additional sub-option for "callout", called "maxwait". For example:
532 verify = sender/callout=5s,maxwait=20s
534 4. Changes to the "personal" filter test:
536 (1) The list of non-personal local parts in From: addresses has been
537 extended to include "listserv", "majordomo", "*-request", and "owner-*",
538 taken from the Sieve specification recommendations.
540 (2) If the message contains any header line starting with "List-" it is
541 treated as non-personal.
543 (3) The test for "circular" in the Subject: header line has been removed
544 because it now seems ill-conceived.
546 5. The autoreply transport has a new option called never_mail. This is an
547 address list. If any run of the transport creates a message with a
548 recipient that matches any item in the list, that recipient is quietly
549 discarded. If all recipients are discarded, no message is created.
552Version 4.40
555The documentation is up-to-date for the 4.40 release. What follows here is a
556brief list of the new features that have been added since 4.30.
558 1. log_incoming_interface affects more log lines.
560 2. New ACL modifier "control = submission".
562 3. CONFIGURE_OWNER can be set at build time to define an alternative owner for
563 the configuration file, in addition to root and exim.
565 4. Added expansion variables $body_zerocount, $recipient_data, and
566 $sender_data.
568 5. The time of last modification of the "new" subdirectory is now used as the
569 "mailbox time last read" when there is a quota error for a maildir
570 delivery.
572 6. The special item "+ignore_unknown" may now appear in host lists.
574 7. The special domain-matching patterns @mx_any, @mx_primary, and
575 @mx_secondary can now be followed by "/ignore=<ip list>".
577 8. New expansion conditions: match_domain, match_address, match_local_part,
578 lt, lti, le, lei, gt, gti, ge, and new expansion operators time_interval,
579 eval10, and base62d.
581 9. New lookup type called "iplsearch".
58310. New log selectors ident_timeout, tls_certificate_verified, queue_time,
584 deliver_time, outgoing_port, return_path_on_delivery.
58611. New global options smtp_active_hostname and tls_require_ciphers.
58812. Exinext has -C and -D options.
59013. "domainlist_cache" forces caching of an apparently variable list.
59214. For compatibility with Sendmail, the command line option -prval:sval
593 is equivalent to -oMr rval -oMs sval.
59515. New callout options use_sender and use_postmaster for use when verifying
596 recipients.
59816. John Jetmore's "exipick" utility has been added to the distribution.
60017. The TLS code now supports CRLs.
60218. The dnslookup router and the dnsdb lookup type now support the use of SRV
603 records.
60519. The redirect router has a new option called qualify_domain.
60720. exigrep's output now also includes lines that are not related to any
608 particular message, but which do match the pattern.
61021. New global option write_rejectlog. If it is set false, Exim no longer
611 writes anything to the reject log.