.cindex "&`+include_unknown`&"
.cindex "&`+ignore_unknown`&"
-By default, Exim behaves as if the host does not match the list. This may not
-always be what you want to happen. To change Exim's behaviour, the special
-items &`+include_unknown`& or &`+ignore_unknown`& may appear in the list (at
-top level &-- they are not recognized in an indirected file).
+Exim parses a host list from left to right. If it encounters a permanent
+lookup failure in any item in the host list before it has found a match,
+Exim treats it as a failure and the default behavior is as if the host
+does not match the list. This may not always be what you want to happen.
+To change Exim's behaviour, the special items &`+include_unknown`& or
+&`+ignore_unknown`& may appear in the list (at top level &-- they are
+not recognized in an indirected file).
.ilist
If any item that follows &`+include_unknown`& requires information that
list. The effect of each one lasts until the next, or until the end of the
list.
+To explain the host/ip processing logic a different way for the same ACL:
+
+.ilist
+If you have name lookups or wildcarded host names and
+IP addresses in the same host list, you should normally put the IP
+addresses first. For example, in an ACL you could have:
+.code
+accept hosts = 10.9.8.7 : *.friend.example
+.endd
+The reason you normally would order it this way lies in the
+left-to-right way that Exim processes lists. It can test IP addresses
+without doing any DNS lookups, but when it reaches an item that requires
+a host name, it fails if it cannot find a host name to compare with the
+pattern. If the above list is given in the opposite order, the
+&%accept%& statement fails for a host whose name cannot be found, even
+if its IP address is 10.9.8.7.
+
+.next
+If you really do want to do the name check first, and still recognize the IP
+address, you can rewrite the ACL like this:
+.code
+accept hosts = *.friend.example
+accept hosts = 10.9.8.7
+.endd
+If the first &%accept%& fails, Exim goes on to try the second one. See chapter
+&<<CHAPACL>>& for details of ACLs. Alternatively, you can use
+&`+ignore_unknown`&, which was discussed in depth in the first example in
+this section.
+.endlist
+
+
.section "Temporary DNS errors when looking up host information" &&&
"SECTtemdnserr"
address. See the &*filter*&, &*map*&, and &*reduce*& items for ways of
processing lists.
+To clarify "list of addresses in RFC 2822 format" mentioned above, Exim follows
+a strict interpretation of header line formatting. Exim parses the bare,
+unquoted portion of an email address and if it finds a comma, treats it as an
+email address seperator. For the example header line:
+.code
+From: =?iso-8859-2?Q?Last=2C_First?= <user@example.com>
+.endd
+The first example below demonstrates that Q-encoded email addresses are parsed
+properly if it is given the raw header (in this example, &`$rheader_from:`&).
+It does not see the comma because it's still encoded as "=2C". The second
+example below is passed the contents of &`$header_from:`&, meaning it gets
+de-mimed. Exim sees the decoded "," so it treats it as &*two*& email addresses.
+The third example shows that the presence of a comma is skipped when it is
+quoted.
+.code
+# exim -be '${addresses:From: \
+=?iso-8859-2?Q?Last=2C_First?= <user@example.com>}'
+user@example.com
+# exim -be '${addresses:From: Last, First <user@example.com>}'
+Last:user@example.com
+# exim -be '${addresses:From: "Last, First" <user@example.com>}'
+user@example.com
+.endd
.vitem &*${base62:*&<&'digits'&>&*}*&
.cindex "&%base62%& expansion item"
part.
.cindex "regular expressions" "in retry rules"
-&*Warning*&: If you use a regular expression in a routing rule pattern, it
+&*Warning*&: If you use a regular expression in a retry rule pattern, it
must match a complete address, not just a domain, because that is how regular
expressions work in address lists.
.display
av_scanner = clamd:/opt/clamd/socket
av_scanner = clamd:192.0.2.3 1234
av_scanner = clamd:192.0.2.3 1234:local
+av_scanner = clamd:192.0.2.3 1234 : 192.0.2.4 1234
.endd
If the value of av_scanner points to a UNIX socket file or contains the local
keyword, then the ClamAV interface will pass a filename containing the data
Exim does not assume that there is a common filesystem with the remote host.
There is an option WITH_OLD_CLAMAV_STREAM in &_src/EDITME_& available, should
you be running a version of ClamAV prior to 0.95.
+
+The final example shows that multiple TCP targets can be specified. Exim will
+randomly use one for each incoming email (i.e. it load balances them). Note
+that only TCP targets may be used if specifying a list of scanners; a UNIX
+socket cannot be mixed in with TCP targets. If one of the servers becomes
+unavailable, Exim will try the remaining one(s) until it finds one that works.
+When a clamd server becomes unreachable, Exim will log a message. Exim does
+not keep track of scanner state between multiple messages, and the scanner
+selection is random, so the message will get logged in the mainlog for each
+email that the down scanner gets chosen first:
+.code
+2013-10-09 14:30:39 1VTumd-0000Y8-BQ malware acl condition: clamd:\
+ connection to localhost, port 3310 failed (Connection refused)
+.endd
+
If the option is unset, the default is &_/tmp/clamd_&. Thanks to David Saez for
contributing the code for this scanner.
projects / exim.git / blobdiff