diff options
author | Jeremy Harris <jgh146exb@wizmail.org> | 2012-06-04 17:48:52 +0100 |
---|---|---|
committer | Jeremy Harris <jgh146exb@wizmail.org> | 2012-06-04 17:48:52 +0100 |
commit | d9b2312be1c63d0bf94dfaea9c82c6def6b45884 (patch) | |
tree | 33bb9b03150f838f0415d06645eedd5ec94af590 /doc/doc-docbook | |
parent | 9940096804c9f3985ca3bc9d862cefa0daa29c96 (diff) |
Add $tls_in_* variables; note the old names as deprecated.
Diffstat (limited to 'doc/doc-docbook')
-rw-r--r-- | doc/doc-docbook/spec.xfpt | 152 |
1 files changed, 100 insertions, 52 deletions
diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index 858438431..0ea36adc2 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -6073,7 +6073,7 @@ The example PLAIN authenticator looks like this: # server_set_id = $auth2 # server_prompts = : # server_condition = Authentication is not yet configured -# server_advertise_condition = ${if def:tls_cipher } +# server_advertise_condition = ${if def:tls_in_cipher } .endd And the example LOGIN authenticator looks like this: .code @@ -6082,7 +6082,7 @@ And the example LOGIN authenticator looks like this: # server_set_id = $auth1 # server_prompts = <| Username: | Password: # server_condition = Authentication is not yet configured -# server_advertise_condition = ${if def:tls_cipher } +# server_advertise_condition = ${if def:tls_in_cipher } .endd The &%server_set_id%& option makes Exim remember the authenticated username @@ -11957,20 +11957,43 @@ command in a filter file. Its use is explained in the description of that command, which can be found in the separate document entitled &'Exim's interfaces to mail filtering'&. -.vitem &$tls_bits$& -.vindex "&$tls_bits$&" -Contains an approximation of the TLS cipher's bit-strength; the meaning of +.vitem &$tls_in_bits$& +.vindex "&$tls_in_bits$&" +Contains an approximation of the TLS cipher's bit-strength +on the inbound connection; the meaning of this depends upon the TLS implementation used. If TLS has not been negotiated, the value will be 0. The value of this is automatically fed into the Cyrus SASL authenticator when acting as a server, to specify the "external SSF" (a SASL term). -.vitem &$tls_certificate_verified$& -.vindex "&$tls_certificate_verified$&" +The deprecated &$tls_bits$& variable refers to the inbound side +except when used in the context of an outbound SMTP delivery, when it refers to +the outbound. + +.vitem &$tls_out_bits$& +.vindex "&$tls_out_bits$&" +Contains an approximation of the TLS cipher's bit-strength +on an outbound SMTP connection; the meaning of +this depends upon the TLS implementation used. +If TLS has not been negotiated, the value will be 0. + +.vitem &$tls_in_certificate_verified$& +.vindex "&$tls_in_certificate_verified$&" This variable is set to &"1"& if a TLS certificate was verified when the message was received, and &"0"& otherwise. -.vitem &$tls_cipher$& +The deprecated &$tls_certificate_verfied$& variable refers to the inbound side +except when used in the context of an outbound SMTP delivery, when it refers to +the outbound. + +.vitem &$tls_out_certificate_verified$& +.vindex "&$tls_out_certificate_verified$&" +This variable is set to &"1"& if a TLS certificate was verified when an +outbound SMTP connection was made, +and &"0"& otherwise. + +.vitem &$tls_in_cipher$& +.vindex "&$tls_in_cipher$&" .vindex "&$tls_cipher$&" When a message is received from a remote host over an encrypted SMTP connection, this variable is set to the cipher suite that was negotiated, for @@ -11979,23 +12002,39 @@ received over unencrypted connections, the variable is empty. Testing &$tls_cipher$& for emptiness is one way of distinguishing between encrypted and non-encrypted connections during ACL processing. -The &$tls_cipher$& variable retains its value during message delivery, except -when an outward SMTP delivery takes place via the &(smtp)& transport. In this -case, &$tls_cipher$& is cleared before any outgoing SMTP connection is made, +The deprecated &$tls_cipher$& variable is the same as &$tls_in_cipher$& during message reception, +but in the context of an outward SMTP delivery taking place via the &(smtp)& transport +becomes the same as &$tls_out_cipher$&. + +.vitem &$tls_out_cipher$& +.vindex "&$tls_out_cipher$&" +This variable is +cleared before any outgoing SMTP connection is made, and then set to the outgoing cipher suite if one is negotiated. See chapter &<<CHAPTLS>>& for details of TLS support and chapter &<<CHAPsmtptrans>>& for details of the &(smtp)& transport. -.vitem &$tls_peerdn$& +.vitem &$tls_in_peerdn$& +.vindex "&$tls_in_peerdn$&" .vindex "&$tls_peerdn$&" When a message is received from a remote host over an encrypted SMTP connection, and Exim is configured to request a certificate from the client, the value of the Distinguished Name of the certificate is made available in the -&$tls_peerdn$& during subsequent processing. Like &$tls_cipher$&, the -value is retained during message delivery, except during outbound SMTP -deliveries. +&$tls_in_peerdn$& during subsequent processing. + +The deprecated &$tls_peerdn$& variable refers to the inbound side +except when used in the context of an outbound SMTP delivery, when it refers to +the outbound. + +.vitem &$tls_out_peerdn$& +.vindex "&$tls_out_peerdn$&" +When a message is being delivered to a remote host over an encrypted SMTP +connection, and Exim is configured to request a certificate from the server, +the value of the Distinguished Name of the certificate is made available in the +&$tls_out_peerdn$& during subsequent processing. -.vitem &$tls_sni$& +.vitem &$tls_in_sni$& +.vindex "&$tls_in_sni$&" .vindex "&$tls_sni$&" .cindex "TLS" "Server Name Indication" When a TLS session is being established, if the client sends the Server @@ -12006,8 +12045,15 @@ will be re-expanded early in the TLS session, to permit a different certificate to be presented (and optionally a different key to be used) to the client, based upon the value of the SNI extension. -The value will be retained for the lifetime of the message. During outbound -SMTP deliveries, it reflects the value of the &%tls_sni%& option on +The deprecated &$tls_sni$& variable refers to the inbound side +except when used in the context of an outbound SMTP delivery, when it refers to +the outbound. + +.vitem &$tls_out_sni$& +.vindex "&$tls_out_sni$&" +.cindex "TLS" "Server Name Indication" +During outbound +SMTP deliveries, this variable reflects the value of the &%tls_sni%& option on the transport. .vitem &$tod_bsdinbox$& @@ -13150,10 +13196,10 @@ If you want to advertise the availability of AUTH only when the connection is encrypted using TLS, you can make use of the fact that the value of this option is expanded, with a setting like this: .code -auth_advertise_hosts = ${if eq{$tls_cipher}{}{}{*}} +auth_advertise_hosts = ${if eq{$tls_in_cipher}{}{}{*}} .endd -.vindex "&$tls_cipher$&" -If &$tls_cipher$& is empty, the session is not encrypted, and the result of +.vindex "&$tls_in_cipher$&" +If &$tls_in_cipher$& is empty, the session is not encrypted, and the result of the expansion is empty, thus matching no hosts. Otherwise, the result of the expansion is *, which matches all hosts. @@ -14878,7 +14924,7 @@ received_header_text = Received: \ ${if def:sender_helo_name {(helo=$sender_helo_name)\n\t}}}}\ by $primary_hostname \ ${if def:received_protocol {with $received_protocol}} \ - ${if def:tls_cipher {($tls_cipher)\n\t}}\ + ${if def:tls_in_cipher {($tls_in_cipher)\n\t}}\ (Exim $version_number)\n\t\ ${if def:sender_address \ {(envelope-from <$sender_address>)\n\t}}\ @@ -15741,7 +15787,7 @@ receiving incoming messages as a server. If you want to supply certificates for use when sending messages as a client, you must set the &%tls_certificate%& option in the relevant &(smtp)& transport. -If the option contains &$tls_sni$& and Exim is built against OpenSSL, then +If the option contains &$tls_out_sni$& and Exim is built against OpenSSL, then if the OpenSSL build supports TLS extensions and the TLS client sends the Server Name Indication extension, then this option and others documented in &<<SECTtlssni>>& will be re-expanded. @@ -22020,6 +22066,9 @@ appropriate values for the outgoing connection, and these are the values that are in force when any authenticators are run and when the &%authenticated_sender%& option is expanded. +These variables are deprecated in favour of &$tls_in_cipher$& et. al. +and will be removed in a future release. + .section "Private options for smtp" "SECID146" .cindex "options" "&(smtp)& transport" @@ -22057,7 +22106,7 @@ ignored. The expansion happens after the outgoing connection has been made and TLS started, if required. This means that the &$host$&, &$host_address$&, -&$tls_cipher$&, and &$tls_peerdn$& variables are set according to the +&$tls_out_cipher$&, and &$tls_out_peerdn$& variables are set according to the particular connection. If the SMTP session is not authenticated, the expansion of @@ -22618,7 +22667,7 @@ ciphers is a preference order. .option tls_sni smtp string&!! unset .cindex "TLS" "Server Name Indication" .vindex "&$tls_sni$&" -If this option is set then it sets the $tls_sni variable and causes any +If this option is set then it sets the $tls_out_sni variable and causes any TLS session to pass this value as the Server Name Indication extension to the remote side, which can be used by the remote side to select an appropriate certificate and private key for the session. @@ -23890,11 +23939,8 @@ When Exim is authenticating as a client, it skips any authenticator whose used, for example, to skip plain text authenticators when the connection is not encrypted by a setting such as: .code -client_condition = ${if !eq{$tls_cipher}{}} +client_condition = ${if !eq{$tls_out_cipher}{}} .endd -(Older documentation incorrectly states that &$tls_cipher$& contains the cipher -used for incoming messages. In fact, during SMTP delivery, it contains the -cipher used for the delivery.) .option driver authenticators string unset @@ -24054,10 +24100,10 @@ authentication mechanisms. For example, it can be used to restrict the advertisement of a particular mechanism to encrypted connections, by a setting such as: .code -server_advertise_condition = ${if eq{$tls_cipher}{}{no}{yes}} +server_advertise_condition = ${if eq{$tls_in_cipher}{}{no}{yes}} .endd -.vindex "&$tls_cipher$&" -If the session is encrypted, &$tls_cipher$& is not empty, and so the expansion +.vindex "&$tls_in_cipher$&" +If the session is encrypted, &$tls_in_cipher$& is not empty, and so the expansion yields &"yes"&, which allows the advertisement to happen. When an Exim server receives an AUTH command from a client, it rejects it @@ -25122,10 +25168,11 @@ name of a directory (for OpenSSL it can be either). .next The default value for &%tls_dhparam%& differs for historical reasons. .next -.vindex "&$tls_peerdn$&" +.vindex "&$tls_in_peerdn$&" +.vindex "&$tls_out_peerdn$&" Distinguished Name (DN) strings reported by the OpenSSL library use a slash for separating fields; GnuTLS uses commas, in accordance with RFC 2253. This -affects the value of the &$tls_peerdn$& variable. +affects the value of the &$tls_in_peerdn$& and &$tls_out_peerdn$& variables. .next OpenSSL identifies cipher suites using hyphens as separators, for example: DES-CBC3-SHA. GnuTLS historically used underscores, for example: @@ -25432,15 +25479,13 @@ forced to fail, Exim behaves as if the option is not set. .cindex "cipher" "logging" .cindex "log" "TLS cipher" -.vindex "&$tls_cipher$&" -The variable &$tls_cipher$& is set to the cipher suite that was negotiated for +.vindex "&$tls_in_cipher$&" +The variable &$tls_in_cipher$& is set to the cipher suite that was negotiated for an incoming TLS connection. It is included in the &'Received:'& header of an incoming message (by default &-- you can, of course, change this), and it is also included in the log line that records a message's arrival, keyed by &"X="&, unless the &%tls_cipher%& log selector is turned off. The &%encrypted%& condition can be used to test for specific cipher suites in ACLs. -(For outgoing SMTP deliveries, &$tls_cipher$& is reset &-- see section -&<<SECID185>>&.) Once TLS has been established, the ACLs that run for subsequent SMTP commands can check the name of the cipher suite and vary their actions accordingly. The @@ -25449,6 +25494,9 @@ example, OpenSSL uses the name DES-CBC3-SHA for the cipher suite which in other contexts is known as TLS_RSA_WITH_3DES_EDE_CBC_SHA. Check the OpenSSL or GnuTLS documentation for more details. +For outgoing SMTP deliveries, &$tls_out_cipher$& is used and logged +(again depending on the &%tls_cipher%& log selector). + .section "Requesting and verifying client certificates" "SECID183" .cindex "certificate" "verification of client" @@ -25485,17 +25533,17 @@ fact that no certificate was verified, and vary their actions accordingly. For example, you can insist on a certificate before accepting a message for relaying, but not when the message is destined for local delivery. -.vindex "&$tls_peerdn$&" +.vindex "&$tls_in_peerdn$&" When a client supplies a certificate (whether it verifies or not), the value of the Distinguished Name of the certificate is made available in the variable -&$tls_peerdn$& during subsequent processing of the message. +&$tls_in_peerdn$& during subsequent processing of the message. .cindex "log" "distinguished name" Because it is often a long text string, it is not included in the log line or &'Received:'& header by default. You can arrange for it to be logged, keyed by &"DN="&, by setting the &%tls_peerdn%& log selector, and you can use &%received_header_text%& to change the &'Received:'& header. When no -certificate is supplied, &$tls_peerdn$& is empty. +certificate is supplied, &$tls_in_peerdn$& is empty. .section "Revoked certificates" "SECID184" @@ -25576,12 +25624,12 @@ All the TLS options in the &(smtp)& transport are expanded before use, with which the client is connected. Forced failure of an expansion causes Exim to behave as if the relevant option were unset. -.vindex &$tls_bits$& -.vindex &$tls_cipher$& -.vindex &$tls_peerdn$& -.vindex &$tls_sni$& +.vindex &$tls_out_bits$& +.vindex &$tls_out_cipher$& +.vindex &$tls_out_peerdn$& +.vindex &$tls_out_sni$& Before an SMTP connection is established, the -&$tls_bits$&, &$tls_cipher$&, &$tls_peerdn$& and &$tls_sni$& +&$tls_out_bits$&, &$tls_out_cipher$&, &$tls_out_peerdn$& and &$tls_out_sni$& variables are emptied. (Until the first connection, they contain the values that were set when the message was received.) If STARTTLS is subsequently successfully obeyed, these variables are set to the relevant values for the @@ -25591,8 +25639,8 @@ outgoing connection. .section "Use of TLS Server Name Indication" "SECTtlssni" .cindex "TLS" "Server Name Indication" -.vindex "&$tls_sni$&" -.oindex "&%tls_sni%&" +.vindex "&$tls_in_sni$&" +.oindex "&%tls_in_sni%&" With TLS1.0 or above, there is an extension mechanism by which extra information can be included at various points in the protocol. One of these extensions, documented in RFC 6066 (and before that RFC 4366) is @@ -25619,14 +25667,14 @@ different clients. Or even negotiate different cipher suites. The &%tls_sni%& option on an SMTP transport is an expanded string; the result, if not empty, will be sent on a TLS session as part of the handshake. There's nothing more to it. Choosing a sensible value not derived insecurely is the -only point of caution. The &$tls_sni$& variable will be set to this string +only point of caution. The &$tls_out_sni$& variable will be set to this string for the lifetime of the client connection (including during authentication). -Except during SMTP client sessions, if &$tls_sni$& is set then it is a string +Except during SMTP client sessions, if &$tls_in_sni$& is set then it is a string received from a client. It can be logged with the &%log_selector%& item &`+tls_sni`&. -If the string &`tls_sni`& appears in the main section's &%tls_certificate%& +If the string &`tls_in_sni`& appears in the main section's &%tls_certificate%& option (prior to expansion) then the following options will be re-expanded during TLS session handshake, to permit alternative values to be chosen: @@ -26640,7 +26688,7 @@ confusing to some people, so the use of &%endpass%& is no longer recommended as This modifier sets up a message that is used as part of the log message if the ACL denies access or a &%warn%& statement's conditions are true. For example: .code -require log_message = wrong cipher suite $tls_cipher +require log_message = wrong cipher suite $tls_in_cipher encrypted = DES-CBC3-SHA .endd &%log_message%& is also used when recipients are discarded by &%discard%&. For |