-. $Cambridge: exim/doc/doc-docbook/spec.xfpt,v 1.65 2009/11/05 19:24:35 nm4 Exp $
+. $Cambridge: exim/doc/doc-docbook/spec.xfpt,v 1.75 2010/06/05 09:10:08 pdp Exp $
.
. /////////////////////////////////////////////////////////////////////////////
. This is the primary source of the Exim Manual. It is an xfpt document that is
. the <bookinfo> element must also be updated for each new edition.
. /////////////////////////////////////////////////////////////////////////////
-.set previousversion "4.69"
-.set version "4.70"
+.set previousversion "4.71"
+.set version "4.72"
.set ACL "access control lists (ACLs)"
.set I " "
<bookinfo>
<title>Specification of the Exim Mail Transfer Agent</title>
<titleabbrev>The Exim MTA</titleabbrev>
-<date>5 November 2009</date>
+<date>29 May 2010</date>
<author><firstname>Exim</firstname><surname>Maintainers</surname></author>
<authorinitials>EM</authorinitials>
<revhistory><revision>
- <revnumber>4.70</revnumber>
- <date>5 November 2009</date>
+ <revnumber>4.72</revnumber>
+ <date>29 May 2010</date>
<authorinitials>EM</authorinitials>
</revision></revhistory>
<copyright><year>2009</year><holder>University of Cambridge</holder></copyright>
A number of pieces of external code are included in the Exim distribution.
.ilist
-.new
Regular expressions are supported in the main Exim program and in the
Exim monitor using the freely-distributable PCRE library, copyright
© University of Cambridge. The source to PCRE is no longer shipped with
Exim, so you will need to use the version of PCRE shipped with your system,
or obtain and install the full version of the library from
&url(ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre).
-.wen
.next
.cindex "cdb" "acknowledgment"
Support for the cdb (Constant DataBase) lookup method is provided by code
For backwards compatibility, ROOT is used if DESTDIR is not set,
but this usage is deprecated.
-.new
.cindex "installing Exim" "what is not installed"
Running &'make install'& does not copy the Exim 4 conversion script
&'convert4r4'&. You will probably run this only once if you are
upgrading from Exim 3. None of the documentation files in the &_doc_&
directory are copied, except for the info files when you have set
INFO_DIRECTORY, as described in section &<<SECTinsinfdoc>>& below.
-.wen
For the utility programs, old versions are renamed by adding the suffix &_.O_&
to their names. The Exim binary itself, however, is handled differently. It is
settings can be obtained by using &%routers%&, &%transports%&, or
&%authenticators%&.
-.new
.cindex "options" "macro &-- extracting"
If invoked by an admin user, then &%macro%&, &%macro_list%& and &%macros%&
are available, similarly to the drivers. Because macros are sometimes used
for storing passwords, this option is restricted.
The output format is one item per line.
-.wen
.vitem &%-bp%&
.oindex "&%-bp%&"
To make the authenticators work, you can use a string expansion
expression like one of the examples in &<<CHAPplaintext>>&.
-.new
Beware that the sequence of the parameters to PLAIN and LOGIN differ; the
usercode and password are in different positions. &<<CHAPplaintext>>&
covers both.
-.wen
.ecindex IIDconfiwal
Jeffrey Friedl's &'Mastering Regular Expressions'&, which is published by
O'Reilly (see &url(http://www.oreilly.com/catalog/regex2/)).
-.new
The documentation for the syntax and semantics of the regular expressions that
are supported by PCRE is included in the PCRE distribution, and no further
description is included here. The PCRE functions are called from Exim using
the default option settings (that is, with no PCRE options set), except that
the PCRE_CASELESS option is set when the matching is required to be
case-insensitive.
-.wen
In most cases, when a regular expression is required in an Exim configuration,
it has to start with a circumflex, in order to distinguish it from plain text
It is permitted to specify a space as the separator character. Further
white space is ignored.
+.new
+.cindex "TXT record" "in &(dnsdb)& lookup"
+For TXT records with multiple items of data, only the first item is returned,
+unless a separator for them is specified using a comma after the separator
+character followed immediately by the TXT record item separator. To concatenate
+items without a separator, use a semicolon instead.
+.code
+${lookup dnsdb{>\n,: txt=a.b.example}}
+${lookup dnsdb{>\n; txt=a.b.example}}
+.endd
+It is permitted to specify a space as the separator character. Further
+white space is ignored.
+.wen
+
.section "Pseudo dnsdb record types" "SECID66"
.cindex "MX record" "in &(dnsdb)& lookup"
By default, both the preference value and the host name are returned for
yields an unchanged string.
+.vitem &*${randint:*&<&'n'&>&*}*&
+.cindex "random number"
+This operator returns a somewhat random number which is less than the
+supplied number and is at least 0. The quality of this randomness depends
+on how Exim was built; the values are not suitable for keying material.
+If Exim is linked against OpenSSL then RAND_pseudo_bytes() is used.
+Otherwise, the implementation may be arc4random(), random() seeded by
+srandomdev() or srandom(), or a custom implementation even weaker than
+random().
+
+
.vitem &*${rfc2047:*&<&'string'&>&*}*&
.cindex "expansion" "RFC 2047"
.cindex "RFC 2047" "expansion operator"
As a special case, the numerical value of an empty string is taken as
zero.
-.new
.vitem &*bool&~{*&<&'string'&>&*}*&
.cindex "expansion" "boolean parsing"
.cindex "&%bool%& expansion condition"
.code
${if bool{$acl_m_privileged_sender} ...
.endd
-.wen
.vitem &*crypteq&~{*&<&'string1'&>&*}{*&<&'string2'&>&*}*&
.cindex "expansion" "encrypted comparison"
.code
server_condition = ${if pwcheck{$auth1:$auth2}}
.endd
-.new
Again, for a PLAIN authenticator configuration, this would be:
.code
server_condition = ${if pwcheck{$auth2:$auth3}}
.endd
-.wen
.vitem &*queue_running*&
.cindex "queue runner" "detecting when delivering from"
.cindex "expansion" "queue runner test"
precise size of the file that has been written. See also
&$message_body_size$&, &$body_linecount$&, and &$body_zerocount$&.
-.new
.cindex "RCPT" "value of &$message_size$&"
While running a per message ACL (mail/rcpt/predata), &$message_size$&
contains the size supplied on the MAIL command, or -1 if no size was given. The
value may not, of course, be truthful.
-.wen
.vitem &$mime_$&&'xxx'&
A number of variables whose names start with &$mime$& are
.row &%gnutls_require_mac%& "control GnuTLS MAC algorithms"
.row &%gnutls_require_protocols%& "control GnuTLS protocols"
.row &%gnutls_compat_mode%& "use GnuTLS compatibility mode"
+.row &%openssl_options%& "adjust OpenSSL compatibility options"
.row &%tls_advertise_hosts%& "advertise TLS to these hosts"
.row &%tls_certificate%& "location of server certificate"
.row &%tls_crl%& "certificate revocation list"
This option controls the protocols when GnuTLS is used in an Exim
server. For details, see section &<<SECTreqciphgnu>>&.
-.new
.option gnutls_compat_mode main boolean unset
This option controls whether GnuTLS is used in compatibility mode in an Exim
server. This reduces security slightly, but improves interworking with older
implementations of TLS.
-.wen
.option headers_charset main string "see below"
This option sets a default character set for translating from encoded MIME
condition &`verify = helo`& is provided to make this possible.
Formerly, it was necessary also to set this option (&%helo_try_verify_hosts%&)
to force the check to occur. From release 4.53 onwards, this is no longer
-necessary. If the check has not been done before &`verify`& &`=`& &`helo`& is
+necessary. If the check has not been done before &`verify = helo`& is
encountered, it is done at that time. Consequently, this option is obsolete.
Its specification is retained here for backwards compatibility.
However, the EHLO or HELO command is not rejected if any of the checks
fail. Processing continues, but the result of the check is remembered, and can
-be detected later in an ACL by the &`verify`& &`=`& &`helo`& condition.
+be detected later in an ACL by the &`verify = helo`& condition.
.option helo_verify_hosts main "host list&!!" unset
.cindex "HELO verifying" "mandatory"
.vindex "&$sender_host_name$&"
After any kind of failure, the host name (in &$sender_host_name$&) remains
unset, and &$host_lookup_failed$& is set to the string &"1"&. See also
-&%dns_again_means_nonexist%&, &%helo_lookup_domains%&, and &`verify`& &`=`&
-&`reverse_host_lookup`& in ACLs.
+&%dns_again_means_nonexist%&, &%helo_lookup_domains%&, and
+&`verify = reverse_host_lookup`& in ACLs.
.option host_lookup_order main "string list" &`bydns:byaddr`&
transport driver.
+.option openssl_options main "string list" +dont_insert_empty_fragments
+.cindex "OpenSSL "compatibility options"
+This option allows an administrator to adjust the SSL options applied
+by OpenSSL to connections. It is given as a space-separated list of items,
+each one to be +added or -subtracted from the current value. The default
+value is one option which happens to have been set historically. You can
+remove all options with:
+.code
+openssl_options = -all
+.endd
+This option is only available if Exim is built against OpenSSL. The values
+available for this option vary according to the age of your OpenSSL install.
+The &"all"& value controls a subset of flags which are available, typically
+the bug workaround options. The &'SSL_CTX_set_options'& man page will
+list the values known on your system and Exim should support all the
+&"bug workaround"& options and many of the &"modifying"& options. The Exim
+names lose the leading &"SSL_OP_"& and are lower-cased.
+
+Note that adjusting the options can have severe impact upon the security of
+SSL as used by Exim. It is possible to disable safety checks and shoot
+yourself in the foot in various unpleasant ways. This option should not be
+adjusted lightly. An unrecognised item will be detected at by invoking Exim
+with the &%-bV%& flag.
+
+An example:
+.code
+openssl_options = -all +microsoft_big_sslv3_buffer
+.endd
+
+
.option oracle_servers main "string list" unset
.cindex "Oracle" "server list"
This option provides a list of Oracle servers and associated connection data,
:defer:
:fail:
.endd
-.new
respectively. When a redirection list contains such an item, it applies
to the entire redirection; any other items in the list are ignored. Any
text following &':fail:'& or &':defer:'& is placed in the error text
associated with the failure. For example, an alias file might contain:
-.wen
.code
X.Employee: :fail: Gone away, no forwarding address
.endd
filter itself, and the original process that reads the result and delivers it
are all run in parallel, like a shell pipeline.
-.new
The filter can perform any transformations it likes, but of course should take
care not to break RFC 2822 syntax. Exim does not check the result, except to
test for a final newline when SMTP is in use. All messages transmitted over
SMTP must end with a newline, so Exim supplies one if it is missing.
-.wen
.cindex "content scanning" "per user"
A transport filter can be used to provide content-scanning on a per-user basis
envelope_to_add
check_string = "From "
escape_string = ">From "
+ umask = 077
user = $local_part
group = mail
instead of using the DNS. Of course, that function may in fact use the DNS, but
it may also consult other sources of information such as &_/etc/hosts_&.
-.option gnutls_require_kx main string unset
+.option gnutls_require_kx smtp string unset
This option controls the key exchange mechanisms when GnuTLS is used in an Exim
client. For details, see section &<<SECTreqciphgnu>>&.
-.option gnutls_require_mac main string unset
+.option gnutls_require_mac smtp string unset
This option controls the MAC algorithms when GnuTLS is used in an Exim
client. For details, see section &<<SECTreqciphgnu>>&.
-.option gnutls_require_protocols main string unset
+.option gnutls_require_protocols smtp string unset
This option controls the protocols when GnuTLS is used in an Exim
client. For details, see section &<<SECTreqciphgnu>>&.
-.new
-.option gnutls_compat_mode main boolean unset
+.option gnutls_compat_mode smtp boolean unset
This option controls whether GnuTLS is used in compatibility mode in an Exim
server. This reduces security slightly, but improves interworking with older
implementations of TLS.
-.wen
.option helo_data smtp string&!! "see below"
.cindex "HELO" "argument, setting"
ldap://ldap.example.org/} }} }
server_set_id = uid=$auth1,ou=people,o=example.org
.endd
-.new
We have to check that the username is not empty before using it, because LDAP
does not permit empty DN components. We must also use the &%quote_ldap_dn%&
operator to correctly quote the DN for authentication. However, the basic
correct one to use for the password, because quoting is needed only to make
the password conform to the Exim syntax. At the LDAP level, the password is an
uninterpreted string.
-.wen
.section "Support for different kinds of authentication" "SECID174"
the current host is abandoned, and the &(smtp)& transport tries to deliver to
alternative hosts, if any.
-.new
&*Note*&:
These options must be set in the &(smtp)& transport for Exim to use TLS when it
is operating as a client. Exim does not assume that a server certificate (set
by the global options of the same name) should also be used when operating as a
client.
-.wen
.vindex "&$host$&"
.vindex "&$host_address$&"
connection is closed. In these special cases, the QUIT ACL does not run.
-.new
.section "The not-QUIT ACL" "SECTNOTQUITACL"
.vindex &$acl_smtp_notquit$&
The not-QUIT ACL, specified by &%acl_smtp_notquit%&, is run in most cases when
trouble, such as being unable to write to its log files, this ACL is not run,
because it might try to do things (such as write to log files) that make the
situation even worse.
-.wen
Like the QUIT ACL, this ACL is provided to make it possible to do customized
logging or to gather statistics, and its outcome is ignored. The &%delay%&
latter is the one defined by &%acl_smtp_predata%&). Setting it tells Exim that
the current message is a submission from a local MUA. In this case, Exim
operates in &"submission mode"&, and applies certain fixups to the message if
-necessary. For example, it add a &'Date:'& header line if one is not present.
+necessary. For example, it adds a &'Date:'& header line if one is not present.
This control is not permitted in the &%acl_smtp_data%& ACL, because that is too
late (the message has already been created).
.vitem &*control&~=&~suppress_local_fixups*&
.cindex "submission fixups, suppressing"
This control applies to locally submitted (non TCP/IP) messages, and is the
-complement of &`control`& &`=`& &`submission`&. It disables the fixups that are
+complement of &`control = submission`&. It disables the fixups that are
normally applied to locally-submitted messages. Specifically:
.ilist
.ilist
Locally submitted, fixups applied: the default.
.next
-Locally submitted, no fixups applied: use &`control`& &`=`&
-&`suppress_local_fixups`&.
+Locally submitted, no fixups applied: use
+&`control = suppress_local_fixups`&.
.next
Remotely submitted, no fixups applied: the default.
.next
-Remotely submitted, fixups applied: use &`control`& &`=`& &`submission`&.
+Remotely submitted, fixups applied: use &`control = submission`&.
.endlist
timeout checks succeed. The &$prvscheck_result$& variable contains the result
of the checks (empty for failure, &"1"& for success).
-.new
There is one more issue you must consider when implementing prvs-signing:
you have to ensure that the routers accept prvs-signed addresses and
deliver them correctly. The easiest way to handle this is to use a &(redirect)&
router to remove the signature with a configuration along these lines:
-.wen
.code
batv_redirect:
driver = redirect
characteristics (for example, the same envelope sender) that resolve to the
same set of hosts, in the same order, are sent in a single SMTP transaction,
even if they are for different domains, unless there are more than the setting
-of the &%max_rcpts%& option in the &(smtp)& transport allows, in which case
-they are split into groups containing no more than &%max_rcpts%& addresses
+of the &%max_rcpt%&s option in the &(smtp)& transport allows, in which case
+they are split into groups containing no more than &%max_rcpt%&s addresses
each. If &%remote_max_parallel%& is greater than one, such groups may be sent
in parallel sessions. The order of hosts with identical MX values is not
significant when checking whether addresses can be batched in this way.
. ////////////////////////////////////////////////////////////////////////////
. ////////////////////////////////////////////////////////////////////////////
-.new
.chapter "Support for DKIM (DomainKeys Identified Mail) - RFC4871" "CHID12" &&&
"DKIM Support"
.cindex "DKIM"
see the documentation of the &%$dkim_verify_status%& expansion variable above
for more information of what they mean.
.endlist
-.wen
. ////////////////////////////////////////////////////////////////////////////
. ////////////////////////////////////////////////////////////////////////////
projects / exim.git / blobdiff