X-Git-Url: https://git.netwichtig.de/gitweb/?a=blobdiff_plain;f=doc%2Fdoc-docbook%2Fspec.xfpt;h=dc4e38c4aa73c129829595c3a131c18e3c58748a;hb=dbb05434c6730ae4a13d5879f6df652d93cd6019;hp=15d909be02188b140a33a1eb933268f8c046cc99;hpb=212c50c3b5dcdf00442933496a44b1d1db6908b5;p=user%2Fhenk%2Fcode%2Fexim.git diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index 15d909be0..dc4e38c4a 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -2810,6 +2810,14 @@ of Exim is installed. It is not necessary to do this when other files that are referenced from the configuration (for example, alias files) are changed, because these are reread each time they are used. +.new +Either a SIGTERM or a SIGINT signal should be used to cause the daemon +to cleanly shut down. +Subprocesses handling recceiving or delivering messages, +or for scanning the queue, +will not be affected by the termination of the daemon process. +.wen + .cmdopt -bdf This option has the same effect as &%-bd%& except that it never disconnects from the controlling terminal, even when no debugging is specified. @@ -4397,15 +4405,21 @@ It is only relevant when the &%-bd%& (start listening daemon) option is also given. Normally the daemon creates this socket, unless a &%-oX%& and &*no*& &%-oP%& option is also present. -If this option is given then the socket will not be created. This could be -required if the system is running multiple daemons. +.new +If this option is given then the socket will not be created. This is required +if the system is running multiple daemons, in which case it should +be used on all. +The features supported by the socket will not be available in such cases. The socket is currently used for .ilist fast ramp-up of queue runner processes .next +caching compiled regexes +.next obtaining a current queue size .endlist +.wen .cmdopt -pd .cindex "Perl" "starting the interpreter" @@ -4489,23 +4503,33 @@ every domain. Addresses are routed, local deliveries happen, but no remote transports are run. Performance will be best if the &%queue_run_in_order%& option is false. -If that is so and the &%queue_fast_ramp%& option is true then -in the first phase of the run, +If that is so and +the &%queue_fast_ramp%& option is true +and a daemon-notifier socket is available +then in the first phase of the run, once a threshold number of messages are routed for a given host, a delivery process is forked in parallel with the rest of the scan. .cindex "hints database" "remembering routing" The hints database that remembers which messages are waiting for specific hosts -is updated, as if delivery to those hosts had been deferred. After this is -complete, a second, normal queue scan happens, with routing and delivery taking -place as normal. Messages that are routed to the same host should mostly be +is updated, as if delivery to those hosts had been deferred. + +After the first queue scan complete, +a second, normal queue scan is done, with routing and delivery taking +place as normal. +Messages that are routed to the same host should mostly be delivered down a single SMTP .cindex "SMTP" "passed connection" .cindex "SMTP" "multiple deliveries" .cindex "multiple SMTP deliveries" connection because of the hints that were set up during the first queue scan. -This option may be useful for hosts that are connected to the Internet + +.new +Two-phase queue runs should be used on systems which, even intermittently, +have a large queue (such as mailing-list operators). +They may also be useful for hosts that are connected to the Internet intermittently. +.wen .vitem &%-q[q]i...%& .oindex "&%-qi%&" @@ -5103,6 +5127,10 @@ The following classes of macros are defined: &` _DRIVER_ROUTER_* `& router drivers &` _DRIVER_TRANSPORT_* `& transport drivers &` _DRIVER_AUTHENTICATOR_* `& authenticator drivers +&` _EXP_COND_* `& expansion conditions +&` _EXP_ITEM_* `& expansion items +&` _EXP_OP_* `& expansion operators +&` _EXP_VAR_* `& expansion variables &` _LOG_* `& log_selector values &` _OPT_MAIN_* `& main config options &` _OPT_ROUTERS_* `& generic router options @@ -7799,7 +7827,8 @@ connection timeout (the system timeout is used), no user or password, no limit on the number of entries returned, and no time limit on queries. When a DN is quoted in the USER= setting for LDAP authentication, Exim -removes any URL quoting that it may contain before passing it LDAP. Apparently +removes any URL quoting that it may contain before passing it to the LDAP library. +Apparently some libraries do this for themselves, but some do not. Removing the URL quoting has two advantages: @@ -9648,7 +9677,10 @@ Example use (as an ACL modifier): .code add_header = :at_start:${authresults {$primary_hostname}} .endd -This is safe even if no authentication results are available. +This is safe even if no authentication results are available +.new +and would generally be placed in the DATA ACL. +.wen .vitem "&*${certextract{*&<&'field'&>&*}{*&<&'certificate'&>&*}&&& @@ -11759,8 +11791,8 @@ Case and collation order are defined per the system C locale. SRS decode. See SECT &<>& for details. -.vitem &*inlist&~{*&<&'string1'&>&*}{*&<&'string2'&>&*}*& &&& - &*inlisti&~{*&<&'string1'&>&*}{*&<&'string2'&>&*}*& +.vitem &*inlist&~{*&<&'subject'&>&*}{*&<&'list'&>&*}*& &&& + &*inlisti&~{*&<&'subject'&>&*}{*&<&'list'&>&*}*& .cindex "string" "comparison" .cindex "list" "iterative conditions" Both strings are expanded; the second string is treated as a list of simple @@ -15613,7 +15645,12 @@ by a setting such as this: .code dns_again_means_nonexist = *.in-addr.arpa .endd -This option applies to all DNS lookups that Exim does. It also applies when the +This option applies to all DNS lookups that Exim does, +.new +except for TLSA lookups (where knowing about such failures +is security-relevant). +.wen +It also applies when the &[gethostbyname()]& or &[getipnodebyname()]& functions give temporary errors, since these are most likely to be caused by DNS lookup problems. The &(dnslookup)& router has some options of its own for controlling what happens @@ -16189,11 +16226,13 @@ case. That is why the default tries a DNS lookup first. .cindex "host" "rejecting connections from" If this option is set, incoming SMTP calls from the hosts listed are rejected as soon as the connection is made. -This option is mostly obsolete, retained for backward compatibility because +This option is obsolete, and retained only for backward compatibility, because nowadays the ACL specified by &%acl_smtp_connect%& can also reject incoming -connections immediately +connections immediately. + .new -(except for tls-on-connect connections). +If the connection is on a TLS-on-connect port then the TCP connection is +just dropped. Otherwise, an SMTP error is sent first. .wen The ability to give an immediate rejection (either by this option or using an @@ -17686,13 +17725,18 @@ This facility is only available on Linux. .cindex "banner for SMTP" .cindex "welcome banner for SMTP" .cindex "customizing" "SMTP banner" -This string, which is expanded every time it is used, is output as the initial +If a connect ACL does not supply a message, +this string (which is expanded every time it is used) is output as the initial positive response to an SMTP connection. The default setting is: .code smtp_banner = $smtp_active_hostname ESMTP Exim \ $version_number $tod_full .endd -Failure to expand the string causes a panic error. If you want to create a +.new +Failure to expand the string causes a panic error; +a forced fail just closes the connection. +.wen +If you want to create a multiline response to the initial SMTP connection, use &"\n"& in the string at appropriate points, but not at the end. Note that the 220 code is not included in this string. Exim adds it automatically (several times in the case of a @@ -18434,20 +18478,27 @@ prior to the 4.80 release, as Debian used to patch Exim to raise the minimum acceptable bound from 1024 to 2048. -.option tls_eccurve main string&!! &`auto`& +.option tls_eccurve main string list&!! &`auto`& .cindex TLS "EC cryptography" -This option selects a EC curve for use by Exim when used with OpenSSL. -It has no effect when Exim is used with GnuTLS. +This option selects EC curves for use by Exim when used with OpenSSL. +It has no effect when Exim is used with GnuTLS +(the equivalent can be done using a priority string for the +&%tls_require_ciphers%& option). -After expansion it must contain a valid EC curve parameter, such as -&`prime256v1`&, &`secp384r1`&, or &`P-512`&. Consult your OpenSSL manual -for valid selections. +After expansion it must contain +.new +one or (only for OpenSSL versiona 1.1.1 onwards) more +.wen +EC curve names, such as &`prime256v1`&, &`secp384r1`&, or &`P-521`&. +Consult your OpenSSL manual for valid curve names. For OpenSSL versions before (and not including) 1.0.2, the string &`auto`& selects &`prime256v1`&. For more recent OpenSSL versions &`auto`& tells the library to choose. -If the option expands to an empty string, no EC curves will be enabled. +.new +If the option expands to an empty string, the effect is undefined. +.wen .option tls_ocsp_file main string&!! unset @@ -22382,7 +22433,7 @@ its removal from incoming messages, so that delivered messages can safely be resent to other recipients. &*Note:*& If used on a transport handling multiple recipients -(the smtp transport unless &%rcpt_max%& is 1, the appendfile, pipe or lmtp +(the smtp transport unless &%max_rcpt%& is 1, the appendfile, pipe or lmtp transport if &%batch_max%& is greater than 1) then information about Bcc recipients will be leaked. Doing so is generally not advised. @@ -25763,12 +25814,22 @@ If this option is set true when the &%protocol%& option is set to &"lmtp"&, the string &`IGNOREQUOTA`& is added to RCPT commands, provided that the LMTP server has advertised support for IGNOREQUOTA in its response to the LHLO command. -.option max_rcpt smtp integer 100 +.option max_rcpt smtp integer&!! 100 .cindex "RCPT" "maximum number of outgoing" -This option limits the number of RCPT commands that are sent in a single -SMTP message transaction. Each set of addresses is treated independently, and +This option, +.new +after expansion, +.wen +limits the number of RCPT commands that are sent in a single +SMTP message transaction. +A value setting of zero disables the limit. + +.new +If a constant is given, +.wen +each set of addresses is treated independently, and so can cause parallel connections to the same host if &%remote_max_parallel%& -permits this. A value setting of zero disables the limit. +permits this. .option message_linelength_limit smtp integer 998 @@ -30483,8 +30544,11 @@ accepted by an &%accept%& verb that has a &%message%& modifier, the contents of the message override the banner message that is otherwise specified by the &%smtp_banner%& option. -For tls-on-connect connections, the ACL is run after the TLS connection -is accepted (however, &%host_reject_connection%& is tested before). +.new +For tls-on-connect connections, the ACL is run before the TLS connection +is accepted; if the ACL does not accept then the TCP connection is dropped without +any TLS startup attempt and without any SMTP response being transmitted. +.wen .subsection "The EHLO/HELO ACL" SECID192 @@ -38889,7 +38953,7 @@ selection marked by asterisks: .irow &`etrn`& * "ETRN commands" .irow &`host_lookup_failed`& * "as it says" .irow &`ident_timeout`&   "timeout for ident connection" -.irow &`incoming_interface`&   "local interface on <= and => lines" +.irow &`incoming_interface`&   "local interface & port on <= and => lines" .irow &`incoming_port`&   "remote port on <= lines" .irow &`lost_incoming_connection`& * "as it says (includes timeouts)" .irow &`millisec`&   "millisecond timestamps and RT,QT,DT,D times"