diff options
70 files changed, 1756 insertions, 980 deletions
diff --git a/.exim-project-root b/.exim-project-root new file mode 100644 index 000000000..4e6e0f9a3 --- /dev/null +++ b/.exim-project-root @@ -0,0 +1 @@ +This file is needed by release-process/scripts/mk_exim_release diff --git a/configs/config.samples/C043 b/configs/config.samples/C043 index 2de6a61b8..e3fcc4fde 100644 --- a/configs/config.samples/C043 +++ b/configs/config.samples/C043 @@ -25,7 +25,7 @@ # configuration file. There are many more than are mentioned here. The # manual is in the file doc/spec.txt in the Exim distribution as a plain # ASCII file. Other formats (PostScript, Texinfo, HTML, PDF) are available -# from the Exim ftp sites. The manual is also online at the Exim web sites. +# from the Exim ftp sites. The manual is also online at the Exim website. # This file is divided into several parts, all but the first of which are diff --git a/configs/config.samples/C047 b/configs/config.samples/C047 index 5a1665aad..7ae9138c1 100644 --- a/configs/config.samples/C047 +++ b/configs/config.samples/C047 @@ -37,11 +37,11 @@ This router has two advantages (for us): 1. You can define the sender host addresses from which you will scan the spam. In my example there are ABC.DEF.GHI.JKL and MNO.PQR.STU.VWX (you have to -substiute this by your real IP-Adresses). +substiute this by your real IP addresses). 2. The spamcheck router only runs in dependency of the existence of the -.spamcheck file. So your users can decide whether or not they wont to use -Spamassassin. Thats important for protection of privacy in germany. +.spamcheck file. So your users can decide whether or not they want to use +Spamassassin. That's important for protection of privacy in Germany. If you don't need this you can simplify the router, for example: @@ -84,6 +84,6 @@ spamcheck: Put the router and the transport on the right places in your exim conf and send -the daemon a HUP signal. Thats all. +the daemon a HUP signal. That's all. - oliver diff --git a/configs/config.samples/C051 b/configs/config.samples/C051 index 6d01aee6e..adb035c08 100644 --- a/configs/config.samples/C051 +++ b/configs/config.samples/C051 @@ -124,7 +124,7 @@ lookup: driver = redirect address_data = GET_ADDRESS_DATA # data is intentionally left blank so that the router will decline - # we just want this router to do a lookup so the results are availble + # we just want this router to do a lookup so the results are available # for the other routers. data = @@ -202,7 +202,7 @@ remote_smtp: driver = smtp # Deliver to the mailbox specified in the LDAP directory. We make sure -# that quota is obeyed, and we try to send a messge to the user if it +# that quota is obeyed, and we try to send a message to the user if it # gets to over 85%. local_delivery: diff --git a/configs/config.samples/F004 b/configs/config.samples/F004 index 655df145f..8feefd754 100644 --- a/configs/config.samples/F004 +++ b/configs/config.samples/F004 @@ -16,15 +16,15 @@ Message-Id: and Resent-Message-Id: headers to world-unique values. # headers to world-unique values. # Notes: -# Change every occurence of "home.dom" to your home domain. -# Change every occurence of "uniqie.remote.dom" to some unique value. +# Change every occurrence of "home.dom" to your home domain. +# Change every occurrence of "uniqie.remote.dom" to some unique value. # Unique values, as Vadik explained in his message to exim-users, # can be chosen in different ways: ### The ideal way is to choose "hostnames" in existing domains whose ### admins you know, and you will be sure that no hostname ending -### with ".nonexistant.friendly.dom" will ever appear on this planet, +### with ".nonexistent.friendly.dom" will ever appear on this planet, ### not even on someone else's message IDs. ### Another ideas include putting after your hostname things like: diff --git a/doc/doc-docbook/Makefile b/doc/doc-docbook/Makefile index ee97257b6..10df9180a 100644 --- a/doc/doc-docbook/Makefile +++ b/doc/doc-docbook/Makefile @@ -11,7 +11,7 @@ notarget:; @echo "** You must specify a target, in the form x.y, where x is ' # Generate all the documentation files... # ## removed info files as I cannot generate them - spec.info filter.info -## removed html files as superceded by new website code +## removed html files as superseded by new website code everything: spec.pdf spec.ps spec.txt \ filter.pdf filter.ps filter.txt \ exim.8 diff --git a/doc/doc-docbook/filter.xfpt b/doc/doc-docbook/filter.xfpt index 8cac5d5c8..e2eece623 100644 --- a/doc/doc-docbook/filter.xfpt +++ b/doc/doc-docbook/filter.xfpt @@ -1189,7 +1189,9 @@ been obeyed, the &(logwrite)& command can be used to write to it: &`e.g. logwrite "$tod_log $message_id processed"`& .endd It is possible to have more than one &(logfile)& command, to specify writing to -different log files in different circumstances. Writing takes place at the end +different log files in different circumstances. +A previously opened log is closed on a subsequent &(logfile)& command. +Writing takes place at the end of the file, and a newline character is added to the end of each string if there isn't one already there. Newlines can be put in the middle of the string by using the &"\n"& escape sequence. Lines from simultaneous deliveries may get diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt index cea0bbc44..415c72712 100644 --- a/doc/doc-docbook/spec.xfpt +++ b/doc/doc-docbook/spec.xfpt @@ -1,6 +1,6 @@ . ///////////////////////////////////////////////////////////////////////////// . This is the primary source of the Exim Manual. It is an xfpt document that is -. converted into DocBook XML for subsequent conversion into printing and online +. converted into DocBook XML for subsequent conversion into printable and online . formats. The markup used herein is "standard" xfpt markup, with some extras. . The markup is summarized in a file called Markup.txt. . @@ -35,7 +35,7 @@ .literal off . ///////////////////////////////////////////////////////////////////////////// -. This generate the outermost <book> element that wraps then entire document. +. This generates the outermost <book> element that wraps the entire document. . ///////////////////////////////////////////////////////////////////////////// .book @@ -45,7 +45,7 @@ . Update the Copyright year (only) when changing content. . ///////////////////////////////////////////////////////////////////////////// -.set previousversion "4.91" +.set previousversion "4.92" .include ./local_params .set ACL "access control lists (ACLs)" @@ -60,12 +60,12 @@ . provided in the xfpt library. . ///////////////////////////////////////////////////////////////////////////// -. --- Override the &$ flag to automatically insert a $ with the variable name +. --- Override the &$ flag to automatically insert a $ with the variable name. .flag &$ $& "<varname>$" "</varname>" . --- Short flags for daggers in option headings. They will always be inside -. --- an italic string, but we want the daggers to be roman. +. --- an italic string, but we want the daggers to be in Roman. .flag &!! "</emphasis>†<emphasis>" .flag &!? "</emphasis>‡<emphasis>" @@ -89,7 +89,7 @@ . --- A macro for the common 2-column tables. The width of the first column . --- is suitable for the many tables at the start of the main options chapter; -. --- the small number of other 2-column tables override it. +. --- a small number of other 2-column tables override it. .macro table2 196pt 254pt .itable none 0 0 2 $1 left $2 left @@ -165,7 +165,7 @@ . //////////////////////////////////////////////////////////////////////////// -. The <bookinfo> element is removed from the XML before processing for Ascii +. The <bookinfo> element is removed from the XML before processing for ASCII . output formats. . //////////////////////////////////////////////////////////////////////////// @@ -337,7 +337,7 @@ Configuration files currently exist for the following operating systems: AIX, BSD/OS (aka BSDI), Darwin (Mac OS X), DGUX, Dragonfly, FreeBSD, GNU/Hurd, GNU/Linux, HI-OSF (Hitachi), HI-UX, HP-UX, IRIX, MIPS RISCOS, NetBSD, OpenBSD, OpenUNIX, QNX, SCO, SCO SVR4.2 (aka UNIX-SV), Solaris (aka SunOS5), SunOS4, -Tru64-Unix (formerly Digital UNIX, formerly DEC-OSF1), Ultrix, and Unixware. +Tru64-Unix (formerly Digital UNIX, formerly DEC-OSF1), Ultrix, and UnixWare. Some of these operating systems are no longer current and cannot easily be tested, so the configuration files may no longer work in practice. @@ -349,8 +349,8 @@ The terms and conditions for the use and distribution of Exim are contained in the file &_NOTICE_&. Exim is distributed under the terms of the GNU General Public Licence, a copy of which may be found in the file &_LICENCE_&. -The use, supply or promotion of Exim for the purpose of sending bulk, -unsolicited electronic mail is incompatible with the basic aims of the program, +The use, supply, or promotion of Exim for the purpose of sending bulk, +unsolicited electronic mail is incompatible with the basic aims of Exim, which revolve around the free provision of a service that enhances the quality of personal communications. The author of Exim regards indiscriminate mass-mailing as an antisocial, irresponsible abuse of the Internet. @@ -371,20 +371,18 @@ contributors. .section "Exim documentation" "SECID1" . Keep this example change bar when updating the documentation! -.new .cindex "documentation" This edition of the Exim specification applies to version &version() of Exim. Substantive changes from the &previousversion; edition are marked in some -renditions of the document; this paragraph is so marked if the rendition is +renditions of this document; this paragraph is so marked if the rendition is capable of showing a change indicator. -.wen This document is very much a reference manual; it is not a tutorial. The reader is expected to have some familiarity with the SMTP mail transfer protocol and with general Unix system administration. Although there are some discussions and examples in places, the information is mostly organized in a way that makes it easy to look up, rather than in a natural order for sequential reading. -Furthermore, the manual aims to cover every aspect of Exim in detail, including +Furthermore, this manual aims to cover every aspect of Exim in detail, including a number of rarely-used, special-purpose features that are unlikely to be of very wide interest. @@ -394,7 +392,7 @@ introductory, and tutorial material can be found in a book entitled &'The Exim SMTP Mail Server'& (second edition, 2007), published by UIT Cambridge (&url(https://www.uit.co.uk/exim-book/)). -This book also contains a chapter that gives a general introduction to SMTP and +The book also contains a chapter that gives a general introduction to SMTP and Internet mail. Inevitably, however, the book is unlikely to be fully up-to-date with the latest release of Exim. (Note that the earlier book about Exim, published by O'Reilly, covers Exim 3, and many things have changed in Exim 4.) @@ -409,7 +407,7 @@ information. .cindex "&_doc/NewStuff_&" .cindex "&_doc/ChangeLog_&" .cindex "change log" -As the program develops, there may be features in newer versions that have not +As Exim develops, there may be features in newer versions that have not yet made it into this document, which is updated only when the most significant digit of the fractional part of the version number changes. Specifications of new features that are not yet in this manual are placed in the file @@ -420,7 +418,7 @@ incompatibly while they are developing, or even be withdrawn. For this reason, they are not documented in this manual. Information about experimental features can be found in the file &_doc/experimental.txt_&. -All changes to the program (whether new features, bug fixes, or other kinds of +All changes to Exim (whether new features, bug fixes, or other kinds of change) are noted briefly in the file called &_doc/ChangeLog_&. .cindex "&_doc/spec.txt_&" @@ -445,8 +443,8 @@ available in other formats (HTML, PostScript, PDF, and Texinfo). Section -.section "FTP and web sites" "SECID2" -.cindex "web site" +.section "FTP site and websites" "SECID2" +.cindex "website" .cindex "FTP site" The primary site for Exim source distributions is the &%exim.org%& FTP site, available over HTTPS, HTTP and FTP. These services, and the &%exim.org%& @@ -454,7 +452,7 @@ website, are hosted at the University of Cambridge. .cindex "wiki" .cindex "FAQ" -As well as Exim distribution tar files, the Exim web site contains a number of +As well as Exim distribution tar files, the Exim website contains a number of differently formatted versions of the documentation. A recent addition to the online information is the Exim wiki (&url(https://wiki.exim.org)), which contains what used to be a separate FAQ, as well as various other @@ -489,7 +487,7 @@ via this web page: .display &url(https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-exim4-users) .endd -Please ask Debian-specific questions on this list and not on the general Exim +Please ask Debian-specific questions on that list and not on the general Exim lists. .section "Bug reports" "SECID5" @@ -505,7 +503,7 @@ message to the &'exim-dev'& mailing list and have it discussed. .section "Where to find the Exim distribution" "SECTavail" .cindex "FTP site" .cindex "HTTPS download site" -.cindex "distribution" "ftp site" +.cindex "distribution" "FTP site" .cindex "distribution" "https site" The master distribution site for the Exim distribution is .display @@ -547,12 +545,12 @@ The distributions will be PGP signed by an individual key of the Release Coordinator. This key will have a uid containing an email address in the &'exim.org'& domain and will have signatures from other people, including other Exim maintainers. We expect that the key will be in the "strong set" of -PGP keys. There should be a trust path to that key from Nigel Metheringham's -PGP key, a version of which can be found in the release directory in the file -&_nigel-pubkey.asc_&. All keys used will be available in public keyserver pools, +PGP keys. There should be a trust path to that key from the Exim Maintainer's +PGP keys, a version of which can be found in the release directory in the file +&_Exim-Maintainers-Keyring.asc_&. All keys used will be available in public keyserver pools, such as &'pool.sks-keyservers.net'&. -At time of last update, releases were being made by Jeremy Harris and signed +At the time of the last update, releases were being made by Jeremy Harris and signed with key &'0xBCE58C8CE41F32DF'&. Other recent keys used for signing are those of Heiko Schlittermann, &'0x26101B62F69376CE'&, and of Phil Pennock, &'0x4D1E900E14C1CC04'&. @@ -563,7 +561,7 @@ The signatures for the tar bundles are in: &_exim-n.nn.tar.gz.asc_& &_exim-n.nn.tar.bz2.asc_& .endd -For each released version, the log of changes is made separately available in a +For each released version, the log of changes is made available in a separate file in the directory &_ChangeLogs_& so that it is possible to find out what has changed without having to download the entire distribution. @@ -621,8 +619,8 @@ a number of common scanners are provided. .endlist -.section "Run time configuration" "SECID7" -Exim's run time configuration is held in a single text file that is divided +.section "Runtime configuration" "SECID7" +Exim's runtime configuration is held in a single text file that is divided into a number of sections. The entries in this file consist of keywords and values, in the style of Smail 3 configuration files. A default configuration file which is suitable for simple online installations is provided in the @@ -636,13 +634,13 @@ can be a straight replacement for &_/usr/lib/sendmail_& or &_/usr/sbin/sendmail_& when sending mail, but you do not need to know anything about Sendmail in order to run Exim. For actions other than sending messages, Sendmail-compatible options also exist, but those that produce output (for -example, &%-bp%&, which lists the messages on the queue) do so in Exim's own +example, &%-bp%&, which lists the messages in the queue) do so in Exim's own format. There are also some additional options that are compatible with Smail 3, and some further options that are new to Exim. Chapter &<<CHAPcommandline>>& documents all Exim's command line options. This information is automatically made into the man page that forms part of the Exim distribution. -Control of messages on the queue can be done via certain privileged command +Control of messages in the queue can be done via certain privileged command line options. There is also an optional monitor program called &'eximon'&, which displays current information in an X window, and which contains a menu interface to Exim's command line administration options. @@ -653,7 +651,7 @@ interface to Exim's command line administration options. .cindex "terminology definitions" .cindex "body of message" "definition of" The &'body'& of a message is the actual data that the sender wants to transmit. -It is the last part of a message, and is separated from the &'header'& (see +It is the last part of a message and is separated from the &'header'& (see below) by a blank line. .cindex "bounce message" "definition of" @@ -698,7 +696,7 @@ line. .cindex "local part" "definition of" .cindex "domain" "definition of" -The term &'local part'&, which is taken from RFC 2822, is used to refer to that +The term &'local part'&, which is taken from RFC 2822, is used to refer to the part of an email address that precedes the @ sign. The part that follows the @ sign is called the &'domain'& or &'mail domain'&. @@ -714,20 +712,20 @@ host it is running on are &'remote'&. message's envelope. .cindex "queue" "definition of" -The term &'queue'& is used to refer to the set of messages awaiting delivery, +The term &'queue'& is used to refer to the set of messages awaiting delivery because this term is in widespread use in the context of MTAs. However, in -Exim's case the reality is more like a pool than a queue, because there is +Exim's case, the reality is more like a pool than a queue, because there is normally no ordering of waiting messages. .cindex "queue runner" "definition of" The term &'queue runner'& is used to describe a process that scans the queue and attempts to deliver those messages whose retry times have come. This term -is used by other MTAs, and also relates to the command &%runq%&, but in Exim +is used by other MTAs and also relates to the command &%runq%&, but in Exim the waiting messages are normally processed in an unpredictable order. .cindex "spool directory" "definition of" The term &'spool directory'& is used for a directory in which Exim keeps the -messages on its queue &-- that is, those that it is in the process of +messages in its queue &-- that is, those that it is in the process of delivering. This should not be confused with the directory in which local mailboxes are stored, which is called a &"spool directory"& by some people. In the Exim documentation, &"spool"& is always used in the first sense. @@ -879,7 +877,7 @@ source code. .next Many people have contributed code fragments, some large, some small, that were -not covered by any specific licence requirements. It is assumed that the +not covered by any specific license requirements. It is assumed that the contributors are happy to see their code incorporated into Exim under the GPL. .endlist @@ -907,9 +905,9 @@ has been down, and it also maintains per-host retry information. .section "Policy control" "SECID11" .cindex "policy control" "overview" Policy controls are now an important feature of MTAs that are connected to the -Internet. Perhaps their most important job is to stop MTAs being abused as +Internet. Perhaps their most important job is to stop MTAs from being abused as &"open relays"& by misguided individuals who send out vast amounts of -unsolicited junk, and want to disguise its source. Exim provides flexible +unsolicited junk and want to disguise its source. Exim provides flexible facilities for specifying policy controls on incoming mail: .ilist @@ -985,7 +983,7 @@ example &`16VDhn-0001bo-D3`&. Each part is a sequence of letters and digits, normally encoding numbers in base 62. However, in the Darwin operating system (Mac OS X) and when Exim is compiled to run under Cygwin, base 36 (avoiding the use of lower case letters) is used instead, because the message -id is used to construct file names, and the names of files in those systems are +id is used to construct filenames, and the names of files in those systems are not always case-sensitive. .cindex "pid (process id)" "re-use of" @@ -1042,7 +1040,7 @@ command line, or from the body of the message if &%-t%& is also used. If the process runs Exim with the &%-bS%& option, the message is also read non-interactively, but in this case the recipients are listed at the start of the message in a series of SMTP RCPT commands, terminated by a DATA -command. This is so-called &"batch SMTP"& format, +command. This is called &"batch SMTP"& format, but it isn't really SMTP. The SMTP commands are just another way of passing envelope addresses in a non-interactive submission. .next @@ -1066,7 +1064,7 @@ constructed from the login name of the user that called Exim and a default qualification domain (which can be set by the &%qualify_domain%& configuration option). For local or batch SMTP, a sender address that is passed using the SMTP MAIL command is ignored. However, the system administrator may allow -certain users (&"trusted users"&) to specify a different sender address +certain users (&"trusted users"&) to specify a different sender addresses unconditionally, or all users to specify certain forms of different sender address. The &%-f%& option or the SMTP MAIL command is used to specify these different addresses. See section &<<SECTtrustedadmin>>& for details of trusted @@ -1074,10 +1072,10 @@ users, and the &%untrusted_set_sender%& option for a way of allowing untrusted users to change sender addresses. Messages received by either of the non-interactive mechanisms are subject to -checking by the non-SMTP ACL, if one is defined. Messages received using SMTP -(either over TCP/IP, or interacting with a local process) can be checked by a +checking by the non-SMTP ACL if one is defined. Messages received using SMTP +(either over TCP/IP or interacting with a local process) can be checked by a number of ACLs that operate at different times during the SMTP session. Either -individual recipients, or the entire message, can be rejected if local policy +individual recipients or the entire message can be rejected if local policy requirements are not met. The &[local_scan()]& function (see chapter &<<CHAPlocalscan>>&) is run for all incoming messages. @@ -1102,7 +1100,7 @@ the two spool files consist of the message id, followed by &`-H`& for the file containing the envelope and header, and &`-D`& for the data file. .cindex "spool directory" "&_input_& sub-directory" -By default all these message files are held in a single directory called +By default, all these message files are held in a single directory called &_input_& inside the general Exim spool directory. Some operating systems do not perform very well if the number of files in a directory gets large; to improve performance in such cases, the &%split_spool_directory%& option can be @@ -1139,7 +1137,7 @@ delivered (see chapters &<<CHAProutergeneric>>& and A message remains in the spool directory until it is completely delivered to its recipients or to an error address, or until it is deleted by an administrator or by the user who originally created it. In cases when delivery -cannot proceed &-- for example, when a message can neither be delivered to its +cannot proceed &-- for example when a message can neither be delivered to its recipients nor returned to its sender, the message is marked &"frozen"& on the spool, and no more deliveries are attempted. @@ -1154,7 +1152,7 @@ to be sent. .oindex "&%ignore_bounce_errors_after%&" There are options called &%ignore_bounce_errors_after%& and &%timeout_frozen_after%&, which discard frozen messages after a certain time. -The first applies only to frozen bounces, the second to any frozen messages. +The first applies only to frozen bounces, the second to all frozen messages. .cindex "message" "log file for" .cindex "log" "file for each message" @@ -1162,7 +1160,7 @@ While Exim is working on a message, it writes information about each delivery attempt to its main log file. This includes successful, unsuccessful, and delayed deliveries for each recipient (see chapter &<<CHAPlog>>&). The log lines are also written to a separate &'message log'& file for each message. -These logs are solely for the benefit of the administrator, and are normally +These logs are solely for the benefit of the administrator and are normally deleted along with the spool files when processing of a message is complete. The use of individual message logs can be disabled by setting &%no_message_logs%&; this might give an improvement in performance on very busy @@ -1179,7 +1177,7 @@ is updated to indicate which these are, and the journal file is then deleted. Updating the spool file is done by writing a new file and renaming it, to minimize the possibility of data loss. -Should the system or the program crash after a successful delivery but before +Should the system or Exim crash after a successful delivery but before the spool file has been updated, the journal is left lying around. The next time Exim attempts to deliver the message, it reads the journal file and updates the spool file before proceeding. This minimizes the chances of double @@ -1194,11 +1192,11 @@ deliveries caused by crashes. The main delivery processing elements of Exim are called &'routers'& and &'transports'&, and collectively these are known as &'drivers'&. Code for a number of them is provided in the source distribution, and compile-time options -specify which ones are included in the binary. Run time options specify which +specify which ones are included in the binary. Runtime options specify which ones are actually used for delivering messages. .cindex "drivers" "instance definition" -Each driver that is specified in the run time configuration is an &'instance'& +Each driver that is specified in the runtime configuration is an &'instance'& of that particular driver type. Multiple instances are allowed; for example, you can set up several different &(smtp)& transports, each with different option values that might specify different ports or different timeouts. Each @@ -1233,8 +1231,8 @@ routers in many different ways, and there may be any number of routers in a configuration. The first router that is specified in a configuration is often one that handles -addresses in domains that are not recognized specially by the local host. These -are typically addresses for arbitrary domains on the Internet. A precondition +addresses in domains that are not recognized specifically by the local host. +Typically these are addresses for arbitrary domains on the Internet. A precondition is set up which looks for the special domains known to the host (for example, its own domain name), and the router is run for addresses that do &'not'& match. Typically, this is a router that looks up domains in the DNS in order to @@ -1271,7 +1269,7 @@ When an address is being verified, the routers are run in &"verify mode"&. This does not affect the way the routers work, but it is a state that can be detected. By this means, a router can be skipped or made to behave differently when verifying. A common example is a configuration in which the first router -sends all messages to a message-scanning program, unless they have been +sends all messages to a message-scanning program unless they have been previously scanned. Thus, the first router accepts all addresses without any checking, making it useless for verifying. Normally, the &%no_verify%& option would be set for such a router, causing it to be skipped in verify mode. @@ -1291,8 +1289,8 @@ the following: .ilist &'accept'&: The router accepts the address, and either assigns it to a -transport, or generates one or more &"child"& addresses. Processing the -original address ceases, +transport or generates one or more &"child"& addresses. Processing the +original address ceases .oindex "&%unseen%&" unless the &%unseen%& option is set on the router. This option can be used to set up multiple deliveries with different routing (for example, @@ -1307,7 +1305,7 @@ child addresses. Unlike &%pass_router%& (see below) the router specified by &%redirect_router%& may be anywhere in the router configuration. .next &'pass'&: The router recognizes the address, but cannot handle it itself. It -requests that the address be passed to another router. By default the address +requests that the address be passed to another router. By default, the address is passed to the next router, but this can be changed by setting the &%pass_router%& option. However, (unlike &%redirect_router%&) the named router must be below the current router (to avoid loops). @@ -1349,8 +1347,8 @@ facility for this purpose. .cindex "address duplicate, discarding" .cindex "duplicate addresses" Once routing is complete, Exim scans the addresses that are assigned to local -and remote transports, and discards any duplicates that it finds. During this -check, local parts are treated as case-sensitive. This happens only when +and remote transports and discards any duplicates that it finds. During this +check, local parts are treated case-sensitively. This happens only when actually delivering a message; when testing routers with &%-bt%&, all the routed addresses are shown. @@ -1470,7 +1468,7 @@ be immediately delivered, the system filter is run each time. The filter condition &%first_delivery%& can be used to detect the first run of the system filter. .next -Each recipient address is offered to each configured router in turn, subject to +Each recipient address is offered to each configured router, in turn, subject to its preconditions, until one is able to handle it. If no router can handle the address, that is, if they all decline, the address is failed. Because routers can be targeted at particular domains, several locally handled domains can be @@ -1547,9 +1545,9 @@ deleted, though the message log can optionally be preserved if required. Exim's mechanism for retrying messages that fail to get delivered at the first attempt is the queue runner process. You must either run an Exim daemon that uses the &%-q%& option with a time interval to start queue runners at regular -intervals, or use some other means (such as &'cron'&) to start them. If you do +intervals or use some other means (such as &'cron'&) to start them. If you do not arrange for queue runners to be run, messages that fail temporarily at the -first attempt will remain on your queue for ever. A queue runner process works +first attempt will remain in your queue forever. A queue runner process works its way through the queue, one message at a time, trying each delivery that has passed its retry time. You can run several queue runners at once. @@ -1618,7 +1616,7 @@ of the list. .section "Failures to deliver bounce messages" "SECID22" .cindex "bounce message" "failure to deliver" If a bounce message (either locally generated or received from a remote host) -itself suffers a permanent delivery failure, the message is left on the queue, +itself suffers a permanent delivery failure, the message is left in the queue, but it is frozen, awaiting the attention of an administrator. There are options that can be used to make Exim discard such failed messages, or to keep them for only a short time (see &%timeout_frozen_after%& and @@ -1663,7 +1661,7 @@ following subdirectories are created: .irow &_util_& "independent utilities" .endtable -The main utility programs are contained in the &_src_& directory, and are built +The main utility programs are contained in the &_src_& directory and are built with the Exim binary. The &_util_& directory contains a few optional scripts that may be useful to some sites. @@ -1688,8 +1686,8 @@ A C99-capable compiler will be required for the build. .section "PCRE library" "SECTpcre" .cindex "PCRE library" Exim no longer has an embedded PCRE library as the vast majority of -modern systems include PCRE as a system library, although you may need -to install the PCRE or PCRE development package for your operating +modern systems include PCRE as a system library, although you may need to +install the PCRE package or the PCRE development package for your operating system. If your system has a normal PCRE installation the Exim build process will need no further configuration. If the library or the headers are in an unusual location you will need to either set the PCRE_LIBS @@ -1738,7 +1736,7 @@ Solaris, operates on two files called &_dbmfile.dir_& and &_dbmfile.pag_&. The GNU library, &'gdbm'&, operates on a single file. If used via its &'ndbm'& compatibility interface it makes two different hard links to it with names &_dbmfile.dir_& and &_dbmfile.pag_&, but if used via its native interface, the -file name is used unmodified. +filename is used unmodified. .next .cindex "Berkeley DB library" The Berkeley DB package, if called via its &'ndbm'& compatibility interface, @@ -1820,17 +1818,17 @@ building Exim for the first time, the simplest thing to do is to copy &_src/EDITME_& to &_Local/Makefile_&, then read it and edit it appropriately. There are three settings that you must supply, because Exim will not build -without them. They are the location of the run time configuration file +without them. They are the location of the runtime configuration file (CONFIGURE_FILE), the directory in which Exim binaries will be installed (BIN_DIRECTORY), and the identity of the Exim user (EXIM_USER and maybe EXIM_GROUP as well). The value of CONFIGURE_FILE can in fact be -a colon-separated list of file names; Exim uses the first of them that exists. +a colon-separated list of filenames; Exim uses the first of them that exists. There are a few other parameters that can be specified either at build time or -at run time, to enable the same binary to be used on a number of different +at runtime, to enable the same binary to be used on a number of different machines. However, if the locations of Exim's spool directory and log file directory (if not within the spool directory) are fixed, it is recommended that -you specify them in &_Local/Makefile_& instead of at run time, so that errors +you specify them in &_Local/Makefile_& instead of at runtime, so that errors detected early in Exim's execution (such as a malformed configuration file) can be logged. @@ -1856,7 +1854,7 @@ happy with the default settings described in &_exim_monitor/EDITME_&, This is all the configuration that is needed in straightforward cases for known operating systems. However, the building process is set up so that it is easy to override options that are set by default or by operating-system-specific -configuration files, for example to change the name of the C compiler, which +configuration files, for example, to change the C compiler, which defaults to &%gcc%&. See section &<<SECToverride>>& below for details of how to do this. @@ -2163,7 +2161,7 @@ libraries need to be installed before compiling Exim. However, there are some optional lookup types (such as cdb) for which the code is entirely contained within Exim, and no external include files or libraries are required. When a lookup type is not included in the -binary, attempts to configure Exim to use it cause run time configuration +binary, attempts to configure Exim to use it cause runtime configuration errors. .cindex "pkg-config" "lookups" @@ -2266,7 +2264,7 @@ As with Exim itself, the final three files need not exist, and in this case the &_OS/eximon.conf-Default_& can be overridden dynamically by setting environment variables of the same name, preceded by EXIMON_. For example, setting EXIMON_LOG_DEPTH in the environment overrides the value of -LOG_DEPTH at run time. +LOG_DEPTH at runtime. .ecindex IIDbuex @@ -2286,10 +2284,10 @@ it may be possible to run Exim without making the binary setuid root (see chapter &<<CHAPsecurity>>& for details). .cindex "CONFIGURE_FILE" -Exim's run time configuration file is named by the CONFIGURE_FILE setting +Exim's runtime configuration file is named by the CONFIGURE_FILE setting in &_Local/Makefile_&. If this names a single file, and the file does not exist, the default configuration file &_src/configure.default_& is copied there -by the installation script. If a run time configuration file already exists, it +by the installation script. If a runtime configuration file already exists, it is left alone. If CONFIGURE_FILE is a colon-separated list, naming several alternative files, no default is installed. @@ -2337,7 +2335,7 @@ INFO_DIRECTORY, as described in section &<<SECTinsinfdoc>>& below. For the utility programs, old versions are renamed by adding the suffix &_.O_& to their names. The Exim binary itself, however, is handled differently. It is installed under a name that includes the version number and the compile number, -for example &_exim-&version()-1_&. The script then arranges for a symbolic link +for example, &_exim-&version()-1_&. The script then arranges for a symbolic link called &_exim_& to point to the binary. If you are updating a previous version of Exim, the script takes care to ensure that the name &_exim_& is never absent from the directory (as seen by other processes). @@ -2385,7 +2383,7 @@ make INSTALL_ARG='-no_symlink exim' install .cindex "installing Exim" "&'info'& documentation" Not all systems use the GNU &'info'& system for documentation, and for this reason, the Texinfo source of Exim's documentation is not included in the main -distribution. Instead it is available separately from the ftp site (see section +distribution. Instead it is available separately from the FTP site (see section &<<SECTavail>>&). If you have defined INFO_DIRECTORY in &_Local/Makefile_& and the Texinfo @@ -2406,7 +2404,7 @@ necessary. .section "Testing" "SECID34" .cindex "testing" "installation" -Having installed Exim, you can check that the run time configuration file is +Having installed Exim, you can check that the runtime configuration file is syntactically valid by running the following command, which assumes that the Exim binary directory is within your PATH environment variable: .code @@ -2480,7 +2478,7 @@ incoming SMTP mail. Testing a new version on a system that is already running Exim can most easily be done by building a binary with a different CONFIGURE_FILE setting. From -within the run time configuration, all other file and directory names +within the runtime configuration, all other file and directory names that Exim uses can be altered, in order to keep it entirely clear of the production version. @@ -2796,7 +2794,7 @@ function, which provides extensive line-editing facilities, for reading the test data. A line history is supported. Long expansion expressions can be split over several lines by using backslash -continuations. As in Exim's run time configuration, white space at the start of +continuations. As in Exim's runtime configuration, white space at the start of continuation lines is ignored. Each argument or data line is passed through the string expansion mechanism, and the result is output. Variable values from the configuration file (for example, &$qualify_domain$&) are available, but no @@ -3130,7 +3128,7 @@ mysql_servers = <value not displayable> If &%config%& is given as an argument, the config is output, as it was parsed, any include file resolved, any comment removed. -If &%config_file%& is given as an argument, the name of the run time +If &%config_file%& is given as an argument, the name of the runtime configuration file is output. (&%configure_file%& works too, for backward compatibility.) If a list of configuration files was supplied, the value that is output here @@ -3186,15 +3184,15 @@ the exit status will be nonzero. .vitem &%-bp%& .oindex "&%-bp%&" -.cindex "queue" "listing messages on" -.cindex "listing" "messages on the queue" +.cindex "queue" "listing messages in" +.cindex "listing" "messages in the queue" This option requests a listing of the contents of the mail queue on the standard output. If the &%-bp%& option is followed by a list of message ids, just those messages are listed. By default, this option can be used only by an admin user. However, the &%queue_list_requires_admin%& option can be set false to allow any user to see the queue. -Each message on the queue is displayed as in the following example: +Each message in the queue is displayed as in the following example: .code 25m 2.9K 0t5C6f-0000c8-00 <alice@wonderland.fict.example> red.king@looking-glass.fict.example @@ -3202,7 +3200,7 @@ Each message on the queue is displayed as in the following example: .endd .cindex "message" "size in queue listing" .cindex "size" "of message" -The first line contains the length of time the message has been on the queue +The first line contains the length of time the message has been in the queue (in this case 25 minutes), the size of the message (2.9K), the unique local identifier for the message, and the message sender, as contained in the envelope. For bounce messages, the sender address is empty, and appears as @@ -3233,7 +3231,7 @@ of just &"D"&. .vitem &%-bpc%& .oindex "&%-bpc%&" .cindex "queue" "count of messages on" -This option counts the number of messages on the queue, and writes the total +This option counts the number of messages in the queue, and writes the total to the standard output. It is restricted to admin users, unless &%queue_list_requires_admin%& is set false. @@ -3242,7 +3240,7 @@ to the standard output. It is restricted to admin users, unless .oindex "&%-bpr%&" This option operates like &%-bp%&, but the output is not sorted into chronological order of message arrival. This can speed it up when there are -lots of messages on the queue, and is particularly useful if the output is +lots of messages in the queue, and is particularly useful if the output is going to be post-processed in a way that doesn't need the sorting. .vitem &%-bpra%& @@ -3413,7 +3411,7 @@ This option causes Exim to write the current version number, compilation number, and compilation date of the &'exim'& binary to the standard output. It also lists the DBM library that is being used, the optional modules (such as specific lookup types), the drivers that are included in the binary, and the -name of the run time configuration file that is in use. +name of the runtime configuration file that is in use. As part of its operation, &%-bV%& causes Exim to read and syntax check its configuration file. However, this is a static check only. It cannot check @@ -3502,10 +3500,10 @@ which the daemon will exit, which should cause inetd to listen once more. .cindex "configuration file" "alternate" .cindex "CONFIGURE_FILE" .cindex "alternate configuration file" -This option causes Exim to find the run time configuration file from the given +This option causes Exim to find the runtime configuration file from the given list instead of from the list specified by the CONFIGURE_FILE -compile-time setting. Usually, the list will consist of just a single file -name, but it can be a colon-separated list of names. In this case, the first +compile-time setting. Usually, the list will consist of just a single filename, +but it can be a colon-separated list of names. In this case, the first file that exists is used. Failure to open an existing file stops Exim from proceeding any further along the list, and an error is generated. @@ -3525,15 +3523,15 @@ even if the caller is root. The reception works, but by that time, Exim is running as the Exim user, so when it re-executes to regain privilege for the delivery, the use of &%-C%& causes privilege to be lost. However, root can test reception and delivery using two separate commands (one to put a message -on the queue, using &%-odq%&, and another to do the delivery, using &%-M%&). +in the queue, using &%-odq%&, and another to do the delivery, using &%-M%&). If ALT_CONFIG_PREFIX is defined &_in Local/Makefile_&, it specifies a prefix string with which any file named in a &%-C%& command line option -must start. In addition, the file name must not contain the sequence &`/../`&. +must start. In addition, the filename must not contain the sequence &`/../`&. However, if the value of the &%-C%& option is identical to the value of CONFIGURE_FILE in &_Local/Makefile_&, Exim ignores &%-C%& and proceeds as usual. There is no default setting for ALT_CONFIG_PREFIX; when it is -unset, any file name can be used with &%-C%&. +unset, any filename can be used with &%-C%&. ALT_CONFIG_PREFIX can be used to confine alternative configuration files to a directory to which only root has access. This prevents someone who has @@ -3661,14 +3659,12 @@ The &`timestamp`& selector causes the current time to be inserted at the start of all debug output lines. This can be useful when trying to track down delays in processing. -.new .cindex debugging "UTF-8 in" .cindex UTF-8 "in debug output" The &`noutf8`& selector disables the use of UTF-8 line-drawing characters to group related information. When disabled. ascii-art is used instead. Using the &`+all`& option does not set this modifier, -.wen If the &%debug_print%& option is set in any driver, it produces output whenever any debugging is selected, or if &%-v%& is used. @@ -3907,7 +3903,7 @@ The arguments give the local address and port being proxied, and the TLS cipher. .oindex "&%-Mc%&" .cindex "hints database" "not overridden by &%-Mc%&" .cindex "delivery" "manually started &-- not forced" -This option requests Exim to run a delivery attempt on each message in turn, +This option requests Exim to run a delivery attempt on each message, in turn, but unlike the &%-M%& option, it does check for retry hints, and respects any that are found. This option is not very useful to external callers. It is provided mainly for internal use by Exim when it needs to re-invoke itself in @@ -3982,7 +3978,7 @@ This option requests Exim to remove the given messages from the queue. No bounce messages are sent; each message is simply forgotten. However, if any of the messages are active, their status is not altered. This option can be used only by an admin user or by the user who originally caused the message to be -placed on the queue. +placed in the queue. . .new . .vitem &%-MS%& @@ -4087,7 +4083,7 @@ Exim. .oindex "&%-oA%&" .cindex "Sendmail compatibility" "&%-oA%& option" This option is used by Sendmail in conjunction with &%-bi%& to specify an -alternative alias file name. Exim handles &%-bi%& differently; see the +alternative alias filename. Exim handles &%-bi%& differently; see the description above. .vitem &%-oB%&&~<&'n'&> @@ -4136,7 +4132,7 @@ However, like &%-odb%&, this option has no effect if &%queue_only_override%& is false and one of the queueing options in the configuration file is in effect. If there is a temporary delivery error during foreground delivery, the -message is left on the queue for later delivery, and the original reception +message is left in the queue for later delivery, and the original reception process exits. See chapter &<<CHAPnonqueueing>>& for a way of setting up a restricted configuration that never queues messages. @@ -4154,7 +4150,7 @@ Sendmail. This option applies to all modes in which Exim accepts incoming messages, including the listening daemon. It specifies that the accepting process should not automatically start a delivery process for each message received. Messages -are placed on the queue, and remain there until a subsequent queue runner +are placed in the queue, and remain there until a subsequent queue runner process encounters them. There are several configuration options (such as &%queue_only%&) that can be used to queue incoming messages under certain conditions. This option overrides all of them and also &%-odqs%&. It always @@ -4172,7 +4168,7 @@ When &%-odqs%& does operate, a delivery process is started for each incoming message, in the background by default, but in the foreground if &%-odi%& is also present. The recipient addresses are routed, and local deliveries are done in the normal way. However, if any SMTP deliveries are required, they are not -done at this time, so the message remains on the queue until a subsequent queue +done at this time, so the message remains in the queue until a subsequent queue runner process encounters it. Because routing was done, Exim knows which messages are waiting for which hosts, and so a number of messages for the same host can be sent in a single SMTP connection. The &%queue_smtp_domains%& @@ -4391,7 +4387,7 @@ This option is relevant only when the &%-bd%& (start listening daemon) option is also given. It controls which ports and interfaces the daemon uses. Details of the syntax, and how it interacts with configuration file options, are given in chapter &<<CHAPinterfaces>>&. When &%-oX%& is used to start a daemon, no pid -file is written unless &%-oP%& is also present to specify a pid file name. +file is written unless &%-oP%& is also present to specify a pid filename. .vitem &%-pd%& .oindex "&%-pd%&" @@ -4493,7 +4489,7 @@ intermittently. .cindex "queue" "initial delivery" If the &'i'& flag is present, the queue runner runs delivery processes only for those messages that haven't previously been tried. (&'i'& stands for &"initial -delivery"&.) This can be helpful if you are putting messages on the queue using +delivery"&.) This can be helpful if you are putting messages in the queue using &%-odq%& and want a queue runner just to process the new messages. .vitem &%-q[q][i]f...%& @@ -4514,7 +4510,7 @@ frozen or not. .oindex "&%-ql%&" .cindex "queue" "local deliveries only" The &'l'& (the letter &"ell"&) flag specifies that only local deliveries are to -be done. If a message requires any remote deliveries, it remains on the queue +be done. If a message requires any remote deliveries, it remains in the queue for later delivery. .vitem &%-q[q][i][f[f]][l][G<name>[/<time>]]]%& @@ -4766,16 +4762,16 @@ under most shells. . //////////////////////////////////////////////////////////////////////////// -.chapter "The Exim run time configuration file" "CHAPconf" &&& +.chapter "The Exim runtime configuration file" "CHAPconf" &&& "The runtime configuration file" -.cindex "run time configuration" +.cindex "runtime configuration" .cindex "configuration file" "general description" .cindex "CONFIGURE_FILE" .cindex "configuration file" "errors in" .cindex "error" "in configuration file" .cindex "return code" "for bad configuration" -Exim uses a single run time configuration file that is read whenever an Exim +Exim uses a single runtime configuration file that is read whenever an Exim binary is executed. Note that in normal operation, this happens frequently, because Exim is designed to operate in a distributed manner, without central control. @@ -4790,7 +4786,7 @@ actually alter the string. The name of the configuration file is compiled into the binary for security reasons, and is specified by the CONFIGURE_FILE compilation option. In most configurations, this specifies a single file. However, it is permitted to -give a colon-separated list of file names, in which case Exim uses the first +give a colon-separated list of filenames, in which case Exim uses the first existing file in the list. .cindex "EXIM_USER" @@ -4799,26 +4795,26 @@ existing file in the list. .cindex "CONFIGURE_GROUP" .cindex "configuration file" "ownership" .cindex "ownership" "configuration file" -The run time configuration file must be owned by root or by the user that is +The runtime configuration file must be owned by root or by the user that is specified at compile time by the CONFIGURE_OWNER option (if set). The configuration file must not be world-writeable, or group-writeable unless its group is the root group or the one specified at compile time by the CONFIGURE_GROUP option. &*Warning*&: In a conventional configuration, where the Exim binary is setuid -to root, anybody who is able to edit the run time configuration file has an +to root, anybody who is able to edit the runtime configuration file has an easy way to run commands as root. If you specify a user or group in the CONFIGURE_OWNER or CONFIGURE_GROUP options, then that user and/or any users who are members of that group will trivially be able to obtain root privileges. -Up to Exim version 4.72, the run time configuration file was also permitted to +Up to Exim version 4.72, the runtime configuration file was also permitted to be writeable by the Exim user and/or group. That has been changed in Exim 4.73 since it offered a simple privilege escalation for any attacker who managed to compromise the Exim user account. A default configuration file, which will work correctly in simple situations, is provided in the file &_src/configure.default_&. If CONFIGURE_FILE -defines just one file name, the installation process copies the default +defines just one filename, the installation process copies the default configuration to a new file of that name if it did not previously exist. If CONFIGURE_FILE is a list, no default is automatically installed. Chapter &<<CHAPdefconfil>>& is a &"walk-through"& discussion of the default @@ -4846,14 +4842,14 @@ delivery, even if the caller is root. The reception works, but by that time, Exim is running as the Exim user, so when it re-execs to regain privilege for the delivery, the use of &%-C%& causes privilege to be lost. However, root can test reception and delivery using two separate commands (one to put a -message on the queue, using &%-odq%&, and another to do the delivery, using +message in the queue, using &%-odq%&, and another to do the delivery, using &%-M%&). If ALT_CONFIG_PREFIX is defined &_in Local/Makefile_&, it specifies a prefix string with which any file named in a &%-C%& command line option must -start. In addition, the file name must not contain the sequence &"&`/../`&"&. -There is no default setting for ALT_CONFIG_PREFIX; when it is unset, any file -name can be used with &%-C%&. +start. In addition, the filename must not contain the sequence &"&`/../`&"&. +There is no default setting for ALT_CONFIG_PREFIX; when it is unset, any +filename can be used with &%-C%&. One-off changes to a configuration can be specified by the &%-D%& command line option, which defines and overrides values for macros used inside the @@ -4875,10 +4871,10 @@ values for the macros satisfy the regexp: &`^[A-Za-z0-9_/.-]*$`& Some sites may wish to use the same Exim binary on different machines that share a file system, but to use different configuration files on each machine. If CONFIGURE_FILE_USE_NODE is defined in &_Local/Makefile_&, Exim first -looks for a file whose name is the configuration file name followed by a dot +looks for a file whose name is the configuration filename followed by a dot and the machine's node name, as obtained from the &[uname()]& function. If this file does not exist, the standard name is tried. This processing occurs for -each file name in the list given by CONFIGURE_FILE or &%-C%&. +each filename in the list given by CONFIGURE_FILE or &%-C%&. In some esoteric situations different versions of Exim may be run under different effective uids and the CONFIGURE_FILE_USE_EUID is defined to @@ -4964,18 +4960,18 @@ described. .cindex "configuration file" "including other files" .cindex "&`.include`& in configuration file" .cindex "&`.include_if_exists`& in configuration file" -You can include other files inside Exim's run time configuration file by +You can include other files inside Exim's runtime configuration file by using this syntax: .display -&`.include`& <&'file name'&> -&`.include_if_exists`& <&'file name'&> +&`.include`& <&'filename'&> +&`.include_if_exists`& <&'filename'&> .endd -on a line by itself. Double quotes round the file name are optional. If you use +on a line by itself. Double quotes round the filename are optional. If you use the first form, a configuration error occurs if the file does not exist; the second form does nothing for non-existent files. The first form allows a relative name. It is resolved relative to -the directory of the including file. For the second form an absolute file -name is required. +the directory of the including file. For the second form an absolute filename +is required. Includes may be nested to any depth, but remember that Exim reads its configuration file often, so it is a good idea to keep them to a minimum. @@ -5017,7 +5013,7 @@ ACL, or in the &%local_scan%&, retry, or rewrite sections of the configuration. .section "Macro substitution" "SECID42" Once a macro is defined, all subsequent lines in the file (and any included files) are scanned for the macro name; if there are several macros, the line is -scanned for each in turn, in the order in which the macros are defined. The +scanned for each, in turn, in the order in which the macros are defined. The replacement text is not re-scanned for the current macro, though it is scanned for subsequently defined macros. For this reason, a macro name may not contain the name of a previously defined macro as a substring. You could, for example, @@ -5522,10 +5518,27 @@ mentioned at all in the default configuration. +.section "Macros" "SECTdefconfmacros" +All macros should be defined before any options. + +One macro is specified, but commented out, in the default configuration: +.code +# ROUTER_SMARTHOST=MAIL.HOSTNAME.FOR.CENTRAL.SERVER.EXAMPLE +.endd +If all off-site mail is expected to be delivered to a "smarthost", then set the +hostname here and uncomment the macro. This will affect which router is used +later on. If this is left commented out, then Exim will perform direct-to-MX +deliveries using a &(dnslookup)& router. + +In addition to macros defined here, Exim includes a number of built-in macros +to enable configuration to be guarded by a binary built with support for a +given feature. See section &<<SECTbuiltinmacros>>& for more details. + + .section "Main configuration settings" "SECTdefconfmain" -The main (global) configuration option settings must always come first in the -file. The first thing you'll see in the file, after some initial comments, is -the line +The main (global) configuration option settings section must always come first +in the file, after the macros. +The first thing you'll see in the file, after some initial comments, is the line .code # primary_hostname = .endd @@ -5607,7 +5620,7 @@ Three more commented-out option settings follow: These are example settings that can be used when Exim is compiled with support for TLS (aka SSL) as described in section &<<SECTinctlsssl>>&. The first one specifies the list of clients that are allowed to use TLS when -connecting to this server; in this case the wildcard means all clients. The +connecting to this server; in this case, the wildcard means all clients. The other options specify where Exim should find its TLS certificate and private key, which together prove the server's identity to any clients that connect. More details are given in chapter &<<CHAPTLS>>&. @@ -5753,7 +5766,7 @@ ignore_bounce_errors_after = 2d timeout_frozen_after = 7d .endd The first of these options specifies that failing bounce messages are to be -discarded after 2 days on the queue. The second specifies that any frozen +discarded after 2 days in the queue. The second specifies that any frozen message (whether a bounce message or not) is to be timed out (and discarded) after a week. In this configuration, the first setting ensures that no failing bounce message ever lasts a week. @@ -5877,7 +5890,7 @@ common convention of local parts constructed as &"&'first-initial.second-initial.family-name'&"& when applied to someone like the author of Exim, who has no second initial.) However, a local part starting with a dot or containing &"/../"& can cause trouble if it is used as part of a -file name (for example, for a mailing list). This is also true for local parts +filename (for example, for a mailing list). This is also true for local parts that contain slashes. A pipe symbol can also be troublesome if the local part is incorporated unthinkingly into a shell command line. @@ -6013,7 +6026,7 @@ by the line begin routers .endd Routers are the modules in Exim that make decisions about where to send -messages. An address is passed to each router in turn, until it is either +messages. An address is passed to each router, in turn, until it is either accepted, or failed. This means that the order in which you define the routers matters. Each router is fully described in its own chapter later in this manual. Here we give only brief overviews. @@ -6028,16 +6041,35 @@ This router is commented out because the majority of sites do not want to support domain literal addresses (those of the form &'user@[10.9.8.7]'&). If you uncomment this router, you also need to uncomment the setting of &%allow_domain_literals%& in the main part of the configuration. + +Which router is used next depends upon whether or not the ROUTER_SMARTHOST +macro has been defined, per .code +.ifdef ROUTER_SMARTHOST +smarthost: +#... +.else dnslookup: - driver = dnslookup +#... +.endif +.endd + +If ROUTER_SMARTHOST has been defined, either at the top of the file or on the +command-line, then we route all non-local mail to that smarthost; otherwise, we'll +perform DNS lookups for direct-to-MX lookup. Any mail which is to a local domain will +skip these routers because of the &%domains%& option. + +.code +smarthost: + driver = manualroute domains = ! +local_domains - transport = remote_smtp - ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 + transport = smarthost_smtp + route_data = ROUTER_SMARTHOST + ignore_target_hosts = <; 0.0.0.0 ; 127.0.0.0/8 ; ::1 no_more .endd -The first uncommented router handles addresses that do not involve any local -domains. This is specified by the line +This router only handles mail which is not to any local domains; this is +specified by the line .code domains = ! +local_domains .endd @@ -6048,6 +6080,29 @@ the start of the configuration). The plus sign before &'local_domains'& indicates that it is referring to a named list. Addresses in other domains are passed on to the following routers. +The name of the router driver is &(manualroute)& because we are manually +specifying how mail should be routed onwards, instead of using DNS MX. +While the name of this router instance is arbitrary, the &%driver%& option must +be one of the driver modules that is in the Exim binary. + +With no pre-conditions other than &%domains%&, all mail for non-local domains +will be handled by this router, and the &%no_more%& setting will ensure that no +other routers will be used for messages matching the pre-conditions. See +&<<SECTrouprecon>>& for more on how the pre-conditions apply. For messages which +are handled by this router, we provide a hostname to deliver to in &%route_data%& +and the macro supplies the value; the address is then queued for the +&(smarthost_smtp)& transport. + +.code +dnslookup: + driver = dnslookup + domains = ! +local_domains + transport = remote_smtp + ignore_target_hosts = 0.0.0.0 : 127.0.0.0/8 + no_more +.endd +The &%domains%& option behaves as per smarthost, above. + The name of the router driver is &(dnslookup)&, and is specified by the &%driver%& option. Do not be confused by the fact that the name of this router instance is the same as the name of the driver. The @@ -6189,17 +6244,89 @@ not matter. The transports section of the configuration starts with .code begin transports .endd -One remote transport and four local transports are defined. +Two remote transports and four local transports are defined. .code remote_smtp: driver = smtp + message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}} +.ifdef _HAVE_DANE + dnssec_request_domains = * + hosts_try_dane = * +.endif +.ifdef _HAVE_PRDR hosts_try_prdr = * +.endif .endd This transport is used for delivering messages over SMTP connections. The list of remote hosts comes from the router. -The &%hosts_try_prdr%& option enables an efficiency SMTP option. -It is negotiated between client and server -and not expected to cause problems but can be disabled if needed. +The &%message_size_limit%& usage is a hack to avoid sending on messages +with over-long lines. The built-in macro _HAVE_DANE guards configuration +to try to use DNSSEC for all queries and to use DANE for delivery; +see section &<<SECDANE>>& for more details. + +The &%hosts_try_prdr%& option enables an efficiency SMTP option. It is +negotiated between client and server and not expected to cause problems +but can be disabled if needed. The built-in macro _HAVE_PRDR guards the +use of the &%hosts_try_prdr%& configuration option. + +The other remote transport is used when delivering to a specific smarthost +with whom there must be some kind of existing relationship, instead of the +usual federated system. + +.code +smarthost_smtp: + driver = smtp + message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}} + multi_domain + # +.ifdef _HAVE_TLS + # Comment out any of these which you have to, then file a Support + # request with your smarthost provider to get things fixed: + hosts_require_tls = * + tls_verify_hosts = * + # As long as tls_verify_hosts is enabled, this won't matter, but if you + # have to comment it out then this will at least log whether you succeed + # or not: + tls_try_verify_hosts = * + # + # The SNI name should match the name which we'll expect to verify; + # many mail systems don't use SNI and this doesn't matter, but if it does, + # we need to send a name which the remote site will recognize. + # This _should_ be the name which the smarthost operators specified as + # the hostname for sending your mail to. + tls_sni = ROUTER_SMARTHOST + # +.ifdef _HAVE_OPENSSL + tls_require_ciphers = HIGH:!aNULL:@STRENGTH +.endif +.ifdef _HAVE_GNUTLS + tls_require_ciphers = SECURE192:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1 +.endif +.endif +.ifdef _HAVE_PRDR + hosts_try_prdr = * +.endif +.endd +After the same &%message_size_limit%& hack, we then specify that this Transport +can handle messages to multiple domains in one run. The assumption here is +that you're routing all non-local mail to the same place and that place is +happy to take all messages from you as quickly as possible. +All other options depend upon built-in macros; if Exim was built without TLS support +then no other options are defined. +If TLS is available, then we configure "stronger than default" TLS ciphersuites +and versions using the &%tls_require_ciphers%& option, where the value to be +used depends upon the library providing TLS. +Beyond that, the options adopt the stance that you should have TLS support available +from your smarthost on today's Internet, so we turn on requiring TLS for the +mail to be delivered, and requiring that the certificate be valid, and match +the expected hostname. The &%tls_sni%& option can be used by service providers +to select an appropriate certificate to present to you and here we re-use the +ROUTER_SMARTHOST macro, because that is unaffected by CNAMEs present in DNS. +You want to specify the hostname which you'll expect to validate for, and that +should not be subject to insecure tampering via DNS results. + +For the &%hosts_try_prdr%& option see the previous transport. + All other options are defaulted. .code local_delivery: @@ -6827,7 +6954,7 @@ passed to a Redis database. See section &<<SECTsql>>&. .next .cindex "sqlite lookup type" .cindex "lookup" "sqlite" -&(sqlite)&: The format of the query is a file name followed by an SQL statement +&(sqlite)&: The format of the query is a filename followed by an SQL statement that is passed to an SQLite database. See section &<<SECTsqlite>>&. .next @@ -7869,7 +7996,7 @@ affected. .section "More about SQLite" "SECTsqlite" .cindex "lookup" "SQLite" .cindex "sqlite lookup type" -SQLite is different to the other SQL lookups because a file name is required in +SQLite is different to the other SQL lookups because a filename is required in addition to the SQL query. An SQLite database is a single file, and there is no daemon as in the other SQL databases. The interface to Exim requires the name of the file, as an absolute path, to be given at the start of the query. It is @@ -8015,11 +8142,11 @@ item. .section "File names in lists" "SECTfilnamlis" -.cindex "list" "file name in" -If an item in a domain, host, address, or local part list is an absolute file -name (beginning with a slash character), each line of the file is read and +.cindex "list" "filename in" +If an item in a domain, host, address, or local part list is an absolute +filename (beginning with a slash character), each line of the file is read and processed as if it were an independent item in the list, except that further -file names are not allowed, +filenames are not allowed, and no expansion of the data from the file takes place. Empty lines in the file are ignored, and the file may also contain comment lines: @@ -8036,12 +8163,12 @@ not#comment@x.y.z # but this is a comment .endd .endlist -Putting a file name in a list has the same effect as inserting each line of the +Putting a filename in a list has the same effect as inserting each line of the file as an item in the list (blank lines and comments excepted). However, there is one important difference: the file is read each time the list is processed, so if its contents vary over time, Exim's behaviour changes. -If a file name is preceded by an exclamation mark, the sense of any match +If a filename is preceded by an exclamation mark, the sense of any match within the file is inverted. For example, if .code hold_domains = !/etc/nohold-domains @@ -8066,7 +8193,7 @@ non-constant pattern. This is not the case. The keys in an &(lsearch)& file are always fixed strings, just as for any other single-key lookup type. If you want to use a file to contain wild-card patterns that form part of a -list, just give the file name on its own, without a search type, as described +list, just give the filename on its own, without a search type, as described in the previous section. You could also use the &(wildlsearch)& or &(nwildlsearch)&, but there is no advantage in doing this. @@ -8313,7 +8440,7 @@ expression by expansion, of course). .cindex "domain list" "matching by lookup" If a pattern starts with the name of a single-key lookup type followed by a semicolon (for example, &"dbm;"& or &"lsearch;"&), the remainder of the pattern -must be a file name in a suitable format for the lookup type. For example, for +must be a filename in a suitable format for the lookup type. For example, for &"cdb;"& it must be an absolute path: .code domains = cdb;/etc/mail/local_domains.cdb @@ -9010,7 +9137,7 @@ default. The domain portion of an address is always lowercased before matching it to an address list. The local part is lowercased by default, and any string comparisons that take place are done caselessly. This means that the data in -the address list itself, in files included as plain file names, and in any file +the address list itself, in files included as plain filenames, and in any file that is looked up using the &"@@"& mechanism, can be in any case. However, the keys in files that are looked up by a search type other than &(lsearch)& (which works caselessly) must be in lower case, because these lookups are not @@ -9057,7 +9184,7 @@ types. .chapter "String expansions" "CHAPexpand" .scindex IIDstrexp "expansion" "of strings" -Many strings in Exim's run time configuration are expanded before use. Some of +Many strings in Exim's runtime configuration are expanded before use. Some of them are expanded every time they are used; others are expanded only once. When a string is being expanded it is copied verbatim from left to right except @@ -9131,7 +9258,7 @@ using &%-be%& for reading files to which they do not have access. .oindex "&%-bem%&" If you want to test expansions that include variables whose values are taken from a message, there are two other options that can be used. The &%-bem%& -option is like &%-be%& except that it is followed by a file name. The file is +option is like &%-be%& except that it is followed by a filename. The file is read as a message before doing the test expansions. For example: .code exim -bem /tmp/test.message '$h_subject:' @@ -9409,8 +9536,7 @@ ${extract{Z}{A=... B=...}{$value} fail } This forces an expansion failure (see section &<<SECTforexpfai>>&); {<&'string2'&>} must be present for &"fail"& to be recognized. -.new -.vitem "&*${extract json {*&<&'key'&>&*}{*&<&'string1'&>&*}{*&<&'string2'&>&*}&&& +.vitem "&*${extract json{*&<&'key'&>&*}{*&<&'string1'&>&*}{*&<&'string2'&>&*}&&& {*&<&'string3'&>&*}}*&" &&& "&*${extract jsons{*&<&'key'&>&*}{*&<&'string1'&>&*}{*&<&'string2'&>&*}&&& {*&<&'string3'&>&*}}*&" @@ -9430,12 +9556,13 @@ Matching of the key against the member names is done case-sensitively. For the &"json"& variant, if a returned value is a JSON string, it retains its leading and trailing quotes. +.new For the &"jsons"& variant, which is intended for use with JSON strings, the leading and trailing quotes are removed from the returned value. +.wen . XXX should be a UTF-8 compare The results of matching are handled as above. -.wen .vitem "&*${extract{*&<&'number'&>&*}{*&<&'separators'&>&*}&&& @@ -9469,7 +9596,6 @@ yields &"99"&. Two successive separators mean that the field between them is empty (for example, the fifth field above). -.new .vitem "&*${extract json {*&<&'number'&>&*}}&&& {*&<&'string1'&>&*}{*&<&'string2'&>&*}{*&<&'string3'&>&*}}*&" &&& "&*${extract jsons{*&<&'number'&>&*}}&&& @@ -9484,6 +9610,7 @@ there is no choice of field separator. For the &"json"& variant, if a returned value is a JSON string, it retains its leading and trailing quotes. +.new For the &"jsons"& variant, which is intended for use with JSON strings, the leading and trailing quotes are removed from the returned value. .wen @@ -9494,7 +9621,8 @@ leading and trailing quotes are removed from the returned value. .cindex "expansion" "selecting from list by condition" .vindex "&$item$&" After expansion, <&'string'&> is interpreted as a list, colon-separated by -default, but the separator can be changed in the usual way. For each item +default, but the separator can be changed in the usual way (&<<SECTlistsepchange>>&). +For each item in this list, its value is place in &$item$&, and then the condition is evaluated. If the condition is true, &$item$& is added to the output as an item in a new list; if the condition is false, the item is discarded. The @@ -9683,7 +9811,7 @@ Then given a message, you can check where it was scanned by looking at the &'X-Spam-Scanned:'& header line. If you know the secret, you can check that this header line is authentic by recomputing the authentication code from the host name, message ID and the &'Message-id:'& header line. This can be done -using Exim's &%-be%& option, or by other means, for example by using the +using Exim's &%-be%& option, or by other means, for example, by using the &'hmac_md5_hex()'& function in Perl. @@ -9751,7 +9879,7 @@ apart from an optional leading minus, and leading and trailing white space (which is ignored). After expansion, <&'string1'&> is interpreted as a list, colon-separated by -default, but the separator can be changed in the usual way. +default, but the separator can be changed in the usual way (&<<SECTlistsepchange>>&). The first field of the list is numbered one. If the number is negative, the fields are @@ -9845,7 +9973,8 @@ ${lookup nisplus {[name=$local_part],passwd.org_dir:gcos} \ .cindex "expansion" "list creation" .vindex "&$item$&" After expansion, <&'string1'&> is interpreted as a list, colon-separated by -default, but the separator can be changed in the usual way. For each item +default, but the separator can be changed in the usual way (&<<SECTlistsepchange>>&). +For each item in this list, its value is place in &$item$&, and then <&'string2'&> is expanded and added to the output as an item in a new list. The separator used for the output list is the same as the one used for the input, but a separator @@ -9942,7 +10071,7 @@ For more discussion and an example, see section &<<SECTverifyPRVS>>&. .cindex "expansion" "inserting an entire file" .cindex "file" "inserting into expansion" .cindex "&%readfile%& expansion item" -The file name and end-of-line string are first expanded separately. The file is +The filename and end-of-line string are first expanded separately. The file is then read, and its contents replace the entire item. All newline characters in the file are replaced by the end-of-line string if it is present. Otherwise, newlines are left in the string. @@ -9997,14 +10126,12 @@ Example, to not do so (preferred, eg. by some webservers): .code ${readsocket{/socket/name}{request string}{3s:shutdown=no}} .endd -.new The second, tls, controls the use of TLS on the connection. Example: .code ${readsocket{/socket/name}{request string}{3s:tls=yes}} .endd The default is to not use TLS. If it is enabled, a shutdown as descripbed above is never done. -.wen A fourth argument allows you to change any newlines that are in the data that is read, in the same way as for &%readfile%& (see above). This example @@ -10050,9 +10177,10 @@ locks out the use of this expansion item in filter files. .vindex "&$item$&" This operation reduces a list to a single, scalar string. After expansion, <&'string1'&> is interpreted as a list, colon-separated by default, but the -separator can be changed in the usual way. Then <&'string2'&> is expanded and +separator can be changed in the usual way (&<<SECTlistsepchange>>&). +Then <&'string2'&> is expanded and assigned to the &$value$& variable. After this, each item in the <&'string1'&> -list is assigned to &$item$& in turn, and <&'string3'&> is expanded for each of +list is assigned to &$item$&, in turn, and <&'string3'&> is expanded for each of them. The result of that expansion is assigned to &$value$& before the next iteration. When the end of the list is reached, the final value of &$value$& is added to the expansion output. The &*reduce*& expansion item can be used in a @@ -10179,7 +10307,7 @@ rather than any Unicode-aware character handling. .cindex list sorting .cindex expansion "list sorting" After expansion, <&'string'&> is interpreted as a list, colon-separated by -default, but the separator can be changed in the usual way. +default, but the separator can be changed in the usual way (&<<SECTlistsepchange>>&). The <&'comparator'&> argument is interpreted as the operator of a two-argument expansion condition. The numeric operators plus ge, gt, le, lt (and ~i variants) are supported. @@ -10376,9 +10504,9 @@ The number is converted to decimal and output as a string. The string must consist entirely of decimal digits. The number is converted to base 62 and output as a string of six characters, including leading zeros. In the few operating environments where Exim uses base 36 instead of base 62 for -its message identifiers (because those systems do not have case-sensitive file -names), base 36 is used by this operator, despite its name. &*Note*&: Just to -be absolutely clear: this is &'not'& base64 encoding. +its message identifiers (because those systems do not have case-sensitive +filenames), base 36 is used by this operator, despite its name. &*Note*&: Just +to be absolutely clear: this is &'not'& base64 encoding. .vitem &*${base62d:*&<&'base-62&~digits'&>&*}*& .cindex "&%base62d%& expansion item" @@ -10553,7 +10681,7 @@ be useful for processing the output of the various hashing functions. .cindex "&%hexquote%& expansion item" This operator converts non-printable characters in a string into a hex escape form. Byte values between 33 (!) and 126 (~) inclusive are left -as is, and other byte values are converted to &`\xNN`&, for example a +as is, and other byte values are converted to &`\xNN`&, for example, a byte value 127 is converted to &`\x7f`&. @@ -10925,7 +11053,6 @@ Case is defined per the system C locale. .cindex "expansion" "utf-8 forcing" .cindex "&%utf8clean%& expansion item" This replaces any invalid utf-8 sequence in the string by the character &`?`&. -.new In versions of Exim before 4.92, this did not correctly do so for a truncated final codepoint's encoding, and the character would be silently dropped. If you must handle detection of this scenario across both sets of Exim behavior, @@ -10938,7 +11065,6 @@ condition = ${if inlist{${utf8clean:${length_1:$local_part}}}{:?}{yes}{no}} .endd (which will false-positive if the first character of the local part is a literal question mark). -.wen .vitem "&*${utf8_domain_to_alabel:*&<&'string'&>&*}*&" &&& "&*${utf8_domain_from_alabel:*&<&'string'&>&*}*&" &&& @@ -11190,7 +11316,8 @@ attempt. It is false during any subsequent delivery attempts. .vindex "&$item$&" These conditions iterate over a list. The first argument is expanded to form the list. By default, the list separator is a colon, but it can be changed by -the normal method. The second argument is interpreted as a condition that is to +the normal method (&<<SECTlistsepchange>>&). +The second argument is interpreted as a condition that is to be applied to each item in the list in turn. During the interpretation of the condition, the current list item is placed in a variable called &$item$&. .ilist @@ -11897,7 +12024,7 @@ address that was connected to. .vindex "&$compile_number$&" The building process for Exim keeps a count of the number of times it has been compiled. This serves to distinguish different -compilations of the same version of the program. +compilations of the same version of Exim. .vitem &$config_dir$& .vindex "&$config_dir$&" @@ -12212,7 +12339,7 @@ any prefix or suffix are in &$local_part_prefix$& and When a message is being delivered to a file, pipe, or autoreply transport as a result of aliasing or forwarding, &$local_part$& is set to the local part of -the parent address, not to the file name or command (see &$address_file$& and +the parent address, not to the filename or command (see &$address_file$& and &$address_pipe$&). When an ACL is running for a RCPT command, &$local_part$& contains the @@ -12645,7 +12772,7 @@ the port value is -1 unless it has been set using the &%-oMi%& command line option. As well as being useful in ACLs (including the &"connect"& ACL), these variable -could be used, for example, to make the file name for a TLS certificate depend +could be used, for example, to make the filename for a TLS certificate depend on which interface and/or port is being used for the incoming connection. The values of &$received_ip_address$& and &$received_port$& are saved with any messages that are received, thus making these variables available at delivery @@ -13601,7 +13728,7 @@ listen. Each item may optionally also specify a port. .endlist The default list separator in both cases is a colon, but this can be changed as -described in section &<<SECTlistconstruct>>&. When IPv6 addresses are involved, +described in section &<<SECTlistsepchange>>&. When IPv6 addresses are involved, it is usually best to change the separator to avoid having to double all the colons. For example: .code @@ -13668,7 +13795,8 @@ the runtime configuration by &%-D%& is allowed only when the caller is root or exim. The value of &%-oX%& is a list of items. The default colon separator can be -changed in the usual way if required. If there are any items that do not +changed in the usual way (&<<SECTlistsepchange>>&) if required. +If there are any items that do not contain dots or colons (that is, are not IP addresses), the value of &%daemon_smtp_ports%& is replaced by the list of those items. If there are any items that do contain dots or colons, the value of &%local_interfaces%& is @@ -13860,7 +13988,7 @@ details. .chapter "Main configuration" "CHAPmainconfig" .scindex IIDconfima "configuration file" "main section" .scindex IIDmaiconf "main configuration" -The first part of the run time configuration file contains three types of item: +The first part of the runtime configuration file contains three types of item: .ilist Macro definitions: These lines start with an upper case letter. See section @@ -14818,7 +14946,7 @@ When a message is delayed, Exim sends a warning message to the sender at intervals specified by this option. The data is a colon-separated list of times after which to send warning messages. If the value of the option is an empty string or a zero time, no warnings are sent. Up to 10 times may be given. If a -message has been on the queue for longer than the last time, the last interval +message has been in the queue for longer than the last time, the last interval between the times is used to compute subsequent warning times. For example, with .code @@ -14968,7 +15096,6 @@ This option controls whether or not an IP address, given as a CSA domain, is reversed and looked up in the reverse DNS, as described in more detail in section &<<SECTverifyCSA>>&. -.new .option dns_cname_loops main integer 1 .cindex DNS "CNAME following" This option controls the following of CNAME chains, needed if the resolver does @@ -14979,7 +15106,6 @@ If you have an ancient one, a value of 10 is likely needed. The default value of one CNAME-follow is needed thanks to the observed return for an MX request, given no MX presence but a CNAME to an A, of the CNAME. -.wen .option dns_dnssec_ok main integer -1 @@ -15424,7 +15550,7 @@ error. .option hold_domains main "domain list&!!" unset .cindex "domain" "delaying delivery" .cindex "delivery" "delaying certain domains" -This option allows mail for particular domains to be held on the queue +This option allows mail for particular domains to be held in the queue manually. The option is overridden if a message delivery is forced with the &%-M%&, &%-qf%&, &%-Rf%& or &%-Sf%& options, and also while testing or verifying addresses using &%-bt%& or &%-bv%&. Otherwise, if a domain matches an @@ -15554,7 +15680,7 @@ suffer temporary delivery failures are of course retried in the usual way.) After a permanent delivery failure, bounce messages are frozen, because there is no sender to whom they can be returned. When a frozen bounce -message has been on the queue for more than the given time, it is unfrozen at +message has been in the queue for more than the given time, it is unfrozen at the next queue run, and a further delivery is attempted. If delivery fails again, the bounce message is discarded. This makes it possible to keep failed bounce messages around for a shorter time than the normal maximum retry time @@ -15822,8 +15948,8 @@ section &<<SECTmessiden>>&. This option sets the path which is used to determine the names of Exim's log files, or indicates that logging is to be to syslog, or both. It is expanded when Exim is entered, so it can, for example, contain a reference to the host -name. If no specific path is set for the log files at compile or run time, -or if the option is unset at run time (i.e. &`log_file_path = `&) +name. If no specific path is set for the log files at compile or runtime, +or if the option is unset at runtime (i.e. &`log_file_path = `&) they are written in a sub-directory called &_log_& in Exim's spool directory. Chapter &<<CHAPlog>>& contains further details about Exim's logging, and section &<<SECTwhelogwri>>& describes how the contents of &%log_file_path%& are @@ -16337,7 +16463,7 @@ See also &%prod_requires_admin%& and &%commandline_checks_require_admin%&. .cindex "queueing incoming messages" .cindex "message" "queueing unconditionally" If &%queue_only%& is set, a delivery process is not automatically started -whenever a message is received. Instead, the message waits on the queue for the +whenever a message is received. Instead, the message waits in the queue for the next queue run. Even if &%queue_only%& is false, incoming messages may not get delivered immediately when certain conditions (such as heavy load) occur. @@ -16445,7 +16571,7 @@ When this option is set, a delivery process is started whenever a message is received, routing is performed, and local deliveries take place. However, if any SMTP deliveries are required for domains that match &%queue_smtp_domains%&, they are not immediately delivered, but instead the -message waits on the queue for the next queue run. Since routing of the message +message waits in the queue for the next queue run. Since routing of the message has taken place, Exim knows to which remote hosts it must be delivered, and so when the queue run happens, multiple messages for the same host are delivered over a single SMTP connection. The &%-odqs%& command line option causes all @@ -16458,7 +16584,7 @@ SMTP deliveries to be queued in this way, and is equivalent to setting .cindex "timeout" "for non-SMTP input" This option sets the timeout for accepting a non-SMTP message, that is, the maximum time that Exim waits when reading a message on the standard input. If -the value is zero, it will wait for ever. This setting is overridden by the +the value is zero, it will wait forever. This setting is overridden by the &%-or%& command line option. The timeout for incoming SMTP messages is controlled by &%smtp_receive_timeout%&. @@ -16792,7 +16918,7 @@ doing this processing, it cannot accept any other incoming connections. .cindex "message" "queueing by SMTP connection count" If the number of simultaneous incoming SMTP connections being handled via the listening daemon exceeds this value, messages received by SMTP are just placed -on the queue; no delivery processes are started automatically. The count is +in the queue; no delivery processes are started automatically. The count is fixed at the start of an SMTP connection. It cannot be updated in the subprocess that receives messages, and so the queueing or not queueing applies to all messages received in the same connection. @@ -16813,7 +16939,7 @@ This option limits the number of delivery processes that Exim starts automatically when receiving messages via SMTP, whether via the daemon or by the use of &%-bs%& or &%-bS%&. If the value of the option is greater than zero, and the number of messages received in a single SMTP session exceeds this -number, subsequent messages are placed on the queue, but no delivery processes +number, subsequent messages are placed in the queue, but no delivery processes are started. This helps to limit the number of Exim processes when a server restarts after downtime and there is a lot of mail waiting for it on other systems. On large systems, the default should probably be increased, and on @@ -17155,11 +17281,11 @@ automatically deleted. When &%split_spool_directory%& is set, the behaviour of queue runner processes changes. Instead of creating a list of all messages in the queue, and then -trying to deliver each one in turn, it constructs a list of those in one +trying to deliver each one, in turn, it constructs a list of those in one sub-directory and tries to deliver them, before moving on to the next sub-directory. The sub-directories are processed in a random order. This spreads out the scanning of the input directories, and uses less memory. It is -particularly beneficial when there are lots of messages on the queue. However, +particularly beneficial when there are lots of messages in the queue. However, if &%queue_run_in_order%& is set, none of this new processing happens. The entire queue has to be scanned and sorted before any deliveries can start. @@ -17368,7 +17494,7 @@ TCP_NODELAY. .cindex "frozen messages" "timing out" .cindex "timeout" "frozen messages" If &%timeout_frozen_after%& is set to a time greater than zero, a frozen -message of any kind that has been on the queue for longer than the given time +message of any kind that has been in the queue for longer than the given time is automatically cancelled at the next queue run. If the frozen message is a bounce message, it is just discarded; otherwise, a bounce is sent to the sender, in a similar manner to cancellation by the &%-Mg%& command line option. @@ -17376,7 +17502,7 @@ If you want to timeout frozen bounce messages earlier than other kinds of frozen message, see &%ignore_bounce_errors_after%&. &*Note:*& the default value of zero means no timeouts; with this setting, -frozen messages remain on the queue forever (except for any frozen bounce +frozen messages remain in the queue forever (except for any frozen bounce messages that are released by &%ignore_bounce_errors_after%&). @@ -17427,7 +17553,7 @@ use when sending messages as a client, you must set the &%tls_certificate%& option in the relevant &(smtp)& transport. &*Note*&: If you use filenames based on IP addresses, change the list -separator in the usual way to avoid confusion under IPv6. +separator in the usual way (&<<SECTlistsepchange>>&) >to avoid confusion under IPv6. &*Note*&: Under versions of OpenSSL preceding 1.1.1, when a list of more than one @@ -17822,7 +17948,7 @@ See &%uucp_from_pattern%& above. .cindex "customizing" "warning message" This option defines a template file containing paragraphs of text to be used for constructing the warning message which is sent by Exim when a message has -been on the queue for a specified amount of time, as specified by +been in the queue for a specified amount of time, as specified by &%delay_warning%&. Details of the file's contents are given in chapter &<<CHAPemsgcust>>&. See also &%bounce_message_file%&. @@ -18232,7 +18358,7 @@ verifying a sender, verification fails. .cindex "fallback" "hosts specified on router" String expansion is not applied to this option. The argument must be a colon-separated list of host names or IP addresses. The list separator can be -changed (see section &<<SECTlistconstruct>>&), and a port can be specified with +changed (see section &<<SECTlistsepchange>>&), and a port can be specified with each name or address. In fact, the format of each item is exactly the same as defined for the list of hosts in a &(manualroute)& router (see section &<<SECTformatonehostitem>>&). @@ -18264,7 +18390,7 @@ and the discussion in chapter &<<CHAPenvironment>>&. .cindex "header lines" "adding" .cindex "router" "adding header lines" This option specifies a list of text headers, -newline-separated (by default, changeable in the usual way), +newline-separated (by default, changeable in the usual way &<<SECTlistsepchange>>&), that is associated with any addresses that are accepted by the router. Each item is separately expanded, at routing time. However, this option has no effect when an address is just being verified. The way in which @@ -18302,7 +18428,7 @@ avoided. The &%repeat_use%& option of the &%redirect%& router may be of help. .cindex "header lines" "removing" .cindex "router" "removing header lines" This option specifies a list of text headers, -colon-separated (by default, changeable in the usual way), +colon-separated (by default, changeable in the usual way &<<SECTlistsepchange>>&), that is associated with any addresses that are accepted by the router. Each item is separately expanded, at routing time. However, this option has no effect when an address is just being verified. The way in which @@ -18585,7 +18711,8 @@ Before running a router, as one of its precondition tests, Exim works its way through the &%require_files%& list, expanding each item separately. Because the list is split before expansion, any colons in expansion items must -be doubled, or the facility for using a different list separator must be used. +be doubled, or the facility for using a different list separator must be used +(&<<SECTlistsepchange>>&). If any expansion is forced to fail, the item is ignored. Other expansion failures cause routing of the address to be deferred. @@ -18607,7 +18734,7 @@ full list of the order in which preconditions are evaluated.) However, as these options are all expanded, you can use the &%exists%& expansion condition to make such tests. The &%require_files%& option is intended for checking files that the router may be going to use internally, or which are needed by a -transport (for example &_.procmailrc_&). +transport (e.g., &_.procmailrc_&). During delivery, the &[stat()]& function is run as root, but there is a facility for some checking of the accessibility of a file by another user. @@ -18647,8 +18774,8 @@ The default action for handling an unresolved EACCES is to consider it to be caused by a configuration error, and routing is deferred because the existence or non-existence of the file cannot be determined. However, in some circumstances it may be desirable to treat this condition as if the file did -not exist. If the file name (or the exclamation mark that precedes the file -name for non-existence) is preceded by a plus sign, the EACCES error is treated +not exist. If the filename (or the exclamation mark that precedes the filename +for non-existence) is preceded by a plus sign, the EACCES error is treated as if the file did not exist. For example: .code require_files = +/some/file @@ -19687,7 +19814,7 @@ and/or IP addresses, optionally also including ports. If the list is written with spaces, it must be protected with quotes. The format of each item in the list is described in the next section. The list separator can be changed -as described in section &<<SECTlistconstruct>>&. +as described in section &<<SECTlistsepchange>>&. If the list of hosts was obtained from a &%route_list%& item, the following variables are set during its expansion: @@ -20254,7 +20381,7 @@ Otherwise, the data must be a comma-separated list of redirection items, as described in the next section. .endlist -When a message is redirected to a file (a &"mail folder"&), the file name given +When a message is redirected to a file (a &"mail folder"&), the filename given in a non-filter redirection list must always be an absolute path. A filter may generate a relative path &-- how this is handled depends on the transport's configuration. See section &<<SECTfildiropt>>& for a discussion of this issue @@ -20266,7 +20393,7 @@ for the &(appendfile)& transport. .cindex "address redirection" "non-filter list items" When the redirection data is not an Exim or Sieve filter, for example, if it comes from a conventional alias or forward file, it consists of a list of -addresses, file names, pipe commands, or certain special items (see section +addresses, filenames, pipe commands, or certain special items (see section &<<SECTspecitredli>>& below). The special items can be individually enabled or disabled by means of options whose names begin with &%allow_%& or &%forbid_%&, depending on their default values. The items in the list are separated by @@ -20400,14 +20527,14 @@ parse as a valid RFC 2822 address that includes a domain. For example, .code /home/world/minbari .endd -is treated as a file name, but +is treated as a filename, but .code /s=molari/o=babylon/@x400gate.way .endd -is treated as an address. For a file name, a transport must be specified using +is treated as an address. For a filename, a transport must be specified using the &%file_transport%& option. However, if the generated path name ends with a forward slash character, it is interpreted as a directory name rather than a -file name, and &%directory_transport%& is used instead. +filename, and &%directory_transport%& is used instead. Normally, either the router or the transport specifies a user and a group under which to run the delivery. The default is to use the Exim user and group. @@ -20511,7 +20638,7 @@ lookup and in &':include:'& files. During routing for message delivery (as opposed to verification), a redirection containing &':fail:'& causes an immediate failure of the incoming address, -whereas &':defer:'& causes the message to remain on the queue so that a +whereas &':defer:'& causes the message to remain in the queue so that a subsequent delivery attempt can happen at a later time. If an address is deferred for too long, it will ultimately fail, because the normal retry rules still apply. @@ -20716,7 +20843,7 @@ A &(redirect)& router sets up a direct delivery to a file when a path name not ending in a slash is specified as a new &"address"&. The transport used is specified by this option, which, after expansion, must be the name of a configured transport. This should normally be an &(appendfile)& transport. When -it is running, the file name is in &$address_file$&. +it is running, the filename is in &$address_file$&. .option filter_prepend_home redirect boolean true @@ -21412,7 +21539,7 @@ value that the router supplies, and also overriding any value associated with .cindex "header lines" "adding in transport" .cindex "transport" "header lines; adding" This option specifies a list of text headers, -newline-separated (by default, changeable in the usual way), +newline-separated (by default, changeable in the usual way &<<SECTlistsepchange>>&), which are (separately) expanded and added to the header portion of a message as it is transported, as described in section &<<SECTheadersaddrem>>&. Additional header lines can also be specified by @@ -21438,7 +21565,7 @@ checked, since this option does not automatically suppress them. .cindex "header lines" "removing" .cindex "transport" "header lines; removing" This option specifies a list of header names, -colon-separated (by default, changeable in the usual way); +colon-separated (by default, changeable in the usual way &<<SECTlistsepchange>>&); these headers are omitted from the message as it is transported, as described in section &<<SECTheadersaddrem>>&. Header removal can also be specified by routers. @@ -22011,7 +22138,7 @@ require "fileinto"; fileinto "folder23"; .endd In this situation, the expansion of &%file%& or &%directory%& in the transport -must transform the relative path into an appropriate absolute file name. In the +must transform the relative path into an appropriate absolute filename. In the case of Sieve filters, the name &'inbox'& must be handled. It is the name that is used as a result of a &"keep"& action in the filter. This example shows one way of handling this requirement: @@ -22138,9 +22265,9 @@ beneath. The option must be set to one of the words &"anywhere"&, &"inhome"&, or &"belowhome"&. In the second and third cases, a home directory must have been -set for the transport. This option is not useful when an explicit file name is -given for normal mailbox deliveries. It is intended for the case when file -names are generated from users' &_.forward_& files. These are usually handled +set for the transport. This option is not useful when an explicit filename is +given for normal mailbox deliveries. It is intended for the case when filenames +are generated from users' &_.forward_& files. These are usually handled by an &(appendfile)& transport called &%address_file%&. See also &%file_must_exist%&. @@ -22562,14 +22689,14 @@ See &%quota%& above. This option applies when one of the delivery modes that writes a separate file for each message is being used. When Exim wants to find the size of one of these files in order to test the quota, it first checks &%quota_size_regex%&. -If this is set to a regular expression that matches the file name, and it +If this is set to a regular expression that matches the filename, and it captures one string, that string is interpreted as a representation of the file's size. The value of &%quota_size_regex%& is not expanded. This feature is useful only when users have no shell access to their mailboxes &-- otherwise they could defeat the quota simply by renaming the files. This facility can be used with maildir deliveries, by setting &%maildir_tag%& to add -the file length to the file name. For example: +the file length to the filename. For example: .code maildir_tag = ,S=$message_size quota_size_regex = ,S=(\d+) @@ -22578,8 +22705,8 @@ An alternative to &$message_size$& is &$message_linecount$&, which contains the number of lines in the message. The regular expression should not assume that the length is at the end of the -file name (even though &%maildir_tag%& puts it there) because maildir MUAs -sometimes add other information onto the ends of message file names. +filename (even though &%maildir_tag%& puts it there) because maildir MUAs +sometimes add other information onto the ends of message filenames. Section &<<SECID136>>& contains further information. @@ -22758,7 +22885,7 @@ Create a &"hitching post"& file whose name is that of the lock file with the current time, primary host name, and process id added, by opening for writing as a new file. If this fails with an access error, delivery is deferred. .next -Close the hitching post file, and hard link it to the lock file name. +Close the hitching post file, and hard link it to the lock filename. .next If the call to &[link()]& succeeds, creation of the lock file has succeeded. Unlink the hitching post name. @@ -22925,11 +23052,11 @@ directory that is defined by the &%directory%& option (the &"delivery directory"&). If the delivery is successful, the file is renamed into the &_new_& subdirectory. -In the file name, <&'stime'&> is the current time of day in seconds, and +In the filename, <&'stime'&> is the current time of day in seconds, and <&'mtime'&> is the microsecond fraction of the time. After a maildir delivery, Exim checks that the time-of-day clock has moved on by at least one microsecond before terminating the delivery process. This guarantees uniqueness for the -file name. However, as a precaution, Exim calls &[stat()]& for the file before +filename. However, as a precaution, Exim calls &[stat()]& for the file before opening it. If any response other than ENOENT (does not exist) is given, Exim waits 2 seconds and tries again, up to &%maildir_retries%& times. @@ -23230,7 +23357,7 @@ recipient is kept when the message is specified by the transport. &*Note*&: This does not apply to &'Cc:'& or &'Bcc:'& recipients. If &%once%& is unset, or is set to an empty string, the message is always sent. -By default, if &%once%& is set to a non-empty file name, the message +By default, if &%once%& is set to a non-empty filename, the message is not sent if a potential recipient is already listed in the database. However, if the &%once_repeat%& option specifies a time greater than zero, the message is sent if that much time has elapsed since a message was last sent to @@ -23511,7 +23638,8 @@ command = /bin/sh -c ${lookup{$local_part}lsearch{/some/file}} .cindex "filter" "transport filter" .vindex "&$pipe_addresses$&" Special handling takes place when an argument consists of precisely the text -&`$pipe_addresses`&. This is not a general expansion variable; the only +&`$pipe_addresses`& (no quotes). +This is not a general expansion variable; the only place this string is recognized is when it appears as an argument for a pipe or transport filter command. It causes each address that is being handled to be inserted in the argument list at that point &'as a separate argument'&. This @@ -24586,7 +24714,8 @@ During the expansion of the &%interface%& option the variables &$host$& and during the expansion of the string. Forced expansion failure, or an empty string result causes the option to be ignored. Otherwise, after expansion, the string must be a list of IP addresses, colon-separated by default, but the -separator can be changed in the usual way. For example: +separator can be changed in the usual way (&<<SECTlistsepchange>>&). +For example: .code interface = <; 192.168.123.123 ; 3ffe:ffff:836f::fe86:a061 .endd @@ -24653,10 +24782,8 @@ and if &%protocol%& is set to &"smtps"& the default is &"smtps"&. If the expansion fails, or if a port number cannot be found, delivery is deferred. -.new Note that at least one Linux distribution has been seen failing to put &"smtps"& in its &"/etc/services"& file, resulting is such deferrals. -.wen @@ -24674,11 +24801,9 @@ over a pipe to a local process &-- see chapter &<<CHAPLMTP>>&. If this option is set to &"smtps"&, the default value for the &%port%& option changes to &"smtps"&, and the transport initiates TLS immediately after connecting, as an outbound SSL-on-connect, instead of using STARTTLS to upgrade. -.new The Internet standards bodies used to strongly discourage use of this mode, but as of RFC 8314 it is perferred over STARTTLS for message submission (as distinct from MTA-MTA communication). -.wen .option retry_include_ip_address smtp boolean&!! true @@ -24907,7 +25032,6 @@ The &%tls_verify_certificates%& option must also be set. If both this option and &%tls_try_verify_hosts%& are unset operation is as if this option selected all hosts. -.new .option utf8_downconvert smtp integer!! unset .cindex utf8 "address downconversion" .cindex i18n "utf8 address downconversion" @@ -24915,7 +25039,6 @@ If built with internationalization support, this option controls conversion of UTF-8 in message addresses to a-label form. For details see section &<<SECTi18nMTA>>&. -.wen @@ -25128,7 +25251,7 @@ transport time. .section "Testing the rewriting rules that apply on input" "SECID149" .cindex "rewriting" "testing" .cindex "testing" "rewriting" -Exim's input rewriting configuration appears in a part of the run time +Exim's input rewriting configuration appears in a part of the runtime configuration file headed by &"begin rewrite"&. It can be tested by the &%-brw%& command line option. This takes an address (which can be a full RFC 2822 address) as its argument. The output is a list of how the address would be @@ -25981,7 +26104,7 @@ intermittently available, or when a message has some attribute that prevents its delivery when others to the same address get through. In this situation, because some messages are successfully delivered, the &"retry clock"& for the host or address keeps getting reset by the successful deliveries, and so -failing messages remain on the queue for ever because the cutoff time is never +failing messages remain in the queue for ever because the cutoff time is never reached. Two exceptional actions are applied to prevent this happening. The first @@ -26013,7 +26136,7 @@ considered immediately. .chapter "SMTP authentication" "CHAPSMTPAUTH" .scindex IIDauthconf1 "SMTP" "authentication configuration" .scindex IIDauthconf2 "authentication" -The &"authenticators"& section of Exim's run time configuration is concerned +The &"authenticators"& section of Exim's runtime configuration is concerned with SMTP authentication. This facility is an extension to the SMTP protocol, described in RFC 2554, which allows a client SMTP host to authenticate itself to a server. This is a common way for a server to recognize clients that are @@ -26905,7 +27028,7 @@ the Cyrus interface, so if your Cyrus library can do, for example, CRAM-MD5, then so can the &(cyrus_sasl)& authenticator. By default it uses the public name of the driver to determine which mechanism to support. -Where access to some kind of secret file is required, for example in GSSAPI +Where access to some kind of secret file is required, for example, in GSSAPI or CRAM-MD5, it is worth noting that the authenticator runs as the Exim user, and that the Cyrus SASL library has no way of escalating privileges by default. You may also find you need to set environment variables, @@ -27050,6 +27173,9 @@ scale to handle future authentication mechanisms, so no guarantee can be made that any particular new authentication mechanism will be supported without code changes in Exim. +Exim's &(gsasl)& authenticator does not have client-side support at this +time; only the server-side support is implemented. Patches welcome. + .option server_channelbinding gsasl boolean false Do not set this true without consulting a cryptographic engineer. @@ -27798,9 +27924,7 @@ the size of the generated prime, so it might still be too large. .oindex "&%tls_require_ciphers%&" "OpenSSL" There is a function in the OpenSSL library that can be passed a list of cipher suites before the cipher negotiation takes place. This specifies which ciphers -.new are acceptable for TLS versions prior to 1.3. -.wen The list is colon separated and may contain names like DES-CBC3-SHA. Exim passes the expanded value of &%tls_require_ciphers%& directly to this function call. @@ -27866,7 +27990,6 @@ This example will prefer ECDSA-authenticated ciphers over RSA ones: tls_require_ciphers = ECDSA:RSA:!COMPLEMENTOFDEFAULT .endd -.new For TLS version 1.3 the control available is less fine-grained and Exim does not provide access to it at present. The value of the &%tls_require_ciphers%& option is ignored when @@ -27876,7 +27999,6 @@ As of writing the library default cipher suite list for TLSv1.3 is .code TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256 .endd -.wen .section "Requiring specific ciphers or other parameters in GnuTLS" &&& @@ -28246,15 +28368,6 @@ checks are made: that the host name (the one in the DNS A record) is valid for the certificate. The option defaults to always checking. -.new -Do not use a client certificate that contains an "OCSP Must-Staple" extension. -TLS 1.2 and below does not support client-side OCSP stapling, and -(as of writing) the TLS libraries do not provide for it even with -TLS 1.3. -Be careful when using the same certificate for server- and -client-certificate for this reason. -.wen - The &(smtp)& transport has two OCSP-related options: &%hosts_require_ocsp%&; a host-list for which a Certificate Status is requested and required for the connection to proceed. The default @@ -28568,7 +28681,6 @@ DANE-TA is commonly used for several services and/or servers, each having a TLSA all of which point to a single TLSA record. DANE-TA and DANE-EE can both be used together. -.new Our recommendation is to use DANE with a certificate from a public CA, because this enables a variety of strategies for remote clients to verify your certificate. @@ -28593,7 +28705,6 @@ The list of requirements is subject to change as best practices evolve. If you're not already using a private CA, or it doesn't meet these requirements, then we encourage you to avoid all these issues and use a public CA such as &url(https://letsencrypt.org/,Let's Encrypt) instead. -.wen The TLSA record should have a Selector field of SPKI(1) and a Matching Type field of SHA2-512(2). @@ -28611,7 +28722,6 @@ are workable for 4th-field hashes. For use with the DANE-TA model, server certificates must have a correct name (SubjectName or SubjectAltName). -.new The Certificate issued by the CA published in the DANE-TA model should be issued using a strong hash algorithm. Exim, and importantly various other MTAs sending to you, will not @@ -28619,7 +28729,6 @@ re-enable hash algorithms which have been disabled by default in TLS libraries. This means no MD5 and no SHA-1. SHA2-256 is the minimum for reliable interoperability (and probably the maximum too, in 2018). -.wen The use of OCSP-stapling should be considered, allowing for fast revocation of certificates (which would otherwise be limited by the DNS TTL on the TLSA records). However, this is likely to only be usable with DANE-TA. NOTE: the @@ -28724,7 +28833,7 @@ incompatible specification changes prior to reaching RFC status). .cindex "control of incoming mail" .cindex "message" "controlling incoming" .cindex "policy control" "access control lists" -Access Control Lists (ACLs) are defined in a separate section of the run time +Access Control Lists (ACLs) are defined in a separate section of the runtime configuration file, headed by &"begin acl"&. Each ACL definition starts with a name, terminated by a colon. Here is a complete ACL section that contains just one very small ACL: @@ -28958,7 +29067,7 @@ for this can be disabled when the variable &$prdr_requested$& is &"yes"&. Any required difference in behaviour of the main DATA-time ACL should however depend on the PRDR-time ACL having run, as Exim -will avoid doing so in some situations (e.g. single-recipient mails). +will avoid doing so in some situations (e.g. single-recipient mails). See also the &%prdr_enable%& global option and the &%hosts_try_prdr%& smtp transport option. @@ -29050,7 +29159,7 @@ configuration file; there are other possibilities. Having expanded the string, Exim searches for an ACL as follows: .ilist -If the string begins with a slash, Exim uses it as a file name, and reads its +If the string begins with a slash, Exim uses it as a filename, and reads its contents as an ACL. The lines are processed in the same way as lines in the Exim configuration file. In particular, continuation lines are supported, blank lines are ignored, as are lines whose first non-whitespace character is &"#"&. @@ -30895,7 +31004,8 @@ MX hosts or nameservers of an email sender address. For an example, see section .section "DNS lists keyed on domain names" "SECID202" .cindex "DNS list" "keyed by domain name" There are some lists that are keyed on domain names rather than inverted IP -addresses. No reversing of components is used +addresses (see, e.g., the &'domain based zones'& link at +&url(http://www.rfc-ignorant.org/)). No reversing of components is used with these lists. You can change the name that is looked up in a DNS list by listing it after the domain name, introduced by a slash. For example, .code @@ -31345,7 +31455,7 @@ rate at which a recipient receives messages, you can use the key ACL. Each &%ratelimit%& condition can have up to four options. A &%per_*%& option -specifies what Exim measures the rate of, for example messages or recipients +specifies what Exim measures the rate of, for example, messages or recipients or bytes. You can adjust the measurement using the &%unique=%& and/or &%count=%& options. You can also control when Exim updates the recorded rate using a &%strict%&, &%leaky%&, or &%readonly%& option. The options are @@ -31459,14 +31569,12 @@ rest of the ACL. The &%leaky%& (default) option means that the client's recorded rate is not updated if it is above the limit. The effect of this is that Exim measures the client's average rate of successfully sent email, -.new up to the given limit. This is appropriate if the countermeasure when the condition is true consists of refusing the message, and is generally the better choice if you have clients that retry automatically. If the action when true is anything more complex then this option is likely not what is wanted. -.wen The &%strict%& option means that the client's recorded rate is always updated. The effect of this is that Exim measures the client's average rate @@ -31637,14 +31745,12 @@ connection, HELO, or MAIL). The main use of these variables is expected to be to distinguish between rejections of MAIL and rejections of RCPT in callouts. -.new The above variables may also be set after a &*successful*& address verification to: .ilist &%random%&: A random local-part callout succeeded .endlist -.wen @@ -32650,7 +32756,7 @@ A regular expression, in which case the message is scanned for viruses. The condition succeeds if a virus is found and its name matches the regular expression. This allows you to take special actions on certain types of virus. Note that &"/"& characters in the RE must be doubled due to the list-processing, -unless the separator is changed (in the usual way). +unless the separator is changed (in the usual way &<<SECTlistsepchange>>&). .endlist You can append a &`defer_ok`& element to the &%malware%& argument list to accept @@ -32733,7 +32839,7 @@ intend to use an instance running on the local host you do not need to set you must set the &%spamd_address%& option in the global part of the Exim configuration as follows (example): .code -spamd_address = 192.168.99.45 387 +spamd_address = 192.168.99.45 783 .endd The SpamAssassin protocol relies on a TCP half-close from the client. If your SpamAssassin client side is running a Linux system with an @@ -32754,14 +32860,14 @@ spamd_address = 127.0.0.1 11333 variant=rspamd As of version 2.60, &%SpamAssassin%& also supports communication over UNIX sockets. If you want to us these, supply &%spamd_address%& with an absolute -file name instead of an address/port pair: +filename instead of an address/port pair: .code spamd_address = /var/run/spamd_socket .endd You can have multiple &%spamd%& servers to improve scalability. These can reside on other hardware reachable over the network. To specify multiple &%spamd%& servers, put multiple address/port pairs in the &%spamd_address%& -option, separated with colons (the separator can be changed in the usual way): +option, separated with colons (the separator can be changed in the usual way &<<SECTlistsepchange>>&): .code spamd_address = 192.168.2.10 783 : \ 192.168.2.11 783 : \ @@ -32774,7 +32880,8 @@ condition defers. Unix and TCP socket specifications may be mixed in any order. Each element of the list is a list itself, space-separated by default -and changeable in the usual way; take care to not double the separator. +and changeable in the usual way (&<<SECTlistsepchange>>&); +take care to not double the separator. For TCP socket specifications a host name or IP (v4 or v6, but subject to list-separator quoting rules) address can be used, @@ -32881,7 +32988,7 @@ available for use at delivery time. .vlist .vitem &$spam_score$& -The spam score of the message, for example &"3.4"& or &"30.5"&. This is useful +The spam score of the message, for example, &"3.4"& or &"30.5"&. This is useful for inclusion in log or reject messages. .vitem &$spam_score_int$& @@ -32991,13 +33098,13 @@ the value can be: .next The string &"default"&. In that case, the file is put in the temporary &"default"& directory <&'spool_directory'&>&_/scan/_&<&'message_id'&>&_/_& with -a sequential file name consisting of the message id and a sequence number. The +a sequential filename consisting of the message id and a sequence number. The full path and name is available in &$mime_decoded_filename$& after decoding. .next A full path name starting with a slash. If the full name is an existing directory, it is used as a replacement for the default directory. The filename is then sequentially assigned. If the path does not exist, it is used as -the full path and file name. +the full path and filename. .next If the string does not start with a slash, it is used as the filename, and the default path is then used. @@ -33085,7 +33192,7 @@ empty string. .vitem &$mime_decoded_filename$& This variable is set only after the &%decode%& modifier (see above) has been -successfully run. It contains the full path and file name of the file +successfully run. It contains the full path and filename of the file containing the decoded data. .endlist @@ -33136,7 +33243,7 @@ condition = ${if eq{$mime_content_type}{text/html}{1}{0}} .endd .vitem &$mime_is_multipart$& This variable has the value 1 (true) when the current part has the main type -&"multipart"&, for example &"multipart/alternative"& or &"multipart/mixed"&. +&"multipart"&, for example, &"multipart/alternative"& or &"multipart/mixed"&. Since multipart entities only serve as containers for other parts, you may not want to carry out specific actions on them. @@ -33241,9 +33348,7 @@ code. The incident is logged on the main and reject logs. .cindex "&[local_scan()]& function" "building Exim to use" To make use of the local scan function feature, you must tell Exim where your function is before building Exim, by setting -.new both HAVE_LOCAL_SCAN and -.wen LOCAL_SCAN_SOURCE in your &_Local/Makefile_&. A recommended place to put it is in the &_Local_& directory, so you might set @@ -33258,7 +33363,7 @@ function controls whether the message is actually accepted or not. There is a commented template function (that just accepts the message) in the file _src/local_scan.c_. -If you want to make use of Exim's run time configuration file to set options +If you want to make use of Exim's runtime configuration file to set options for your &[local_scan()]& function, you must also set .code LOCAL_SCAN_HAS_OPTIONS=yes @@ -33270,6 +33375,7 @@ in &_Local/Makefile_& (see section &<<SECTconoptloc>>& below). .section "API for local_scan()" "SECTapiforloc" .cindex "&[local_scan()]& function" "API description" +.cindex &%dlfunc%& "API description" You must include this line near the start of your code: .code #include "local_scan.h" @@ -35585,7 +35691,7 @@ accepted. .chapter "Customizing bounce and warning messages" "CHAPemsgcust" &&& "Customizing messages" -When a message fails to be delivered, or remains on the queue for more than a +When a message fails to be delivered, or remains in the queue for more than a configured amount of time, Exim sends a message to the original sender, or to an alternative configured address. The text of these messages is built into the code of Exim, but it is possible to change it, either by adding a single @@ -35698,7 +35804,7 @@ A message ${if eq{$sender_address}{$warn_message_recipients} <$sender_address> }}has not been delivered to all of its recipients after -more than $warn_message_delay on the queue on $primary_hostname. +more than $warn_message_delay in the queue on $primary_hostname. The message identifier is: $message_exim_id The subject of the message is: $h_subject @@ -35780,7 +35886,7 @@ such file, the router declines, but because &%no_more%& is set, no subsequent routers are tried, and so the whole delivery fails. The &%forbid_pipe%& and &%forbid_file%& options prevent a local part from being -expanded into a file name or a pipe delivery, which is usually inappropriate in +expanded into a filename or a pipe delivery, which is usually inappropriate in a mailing list. .oindex "&%errors_to%&" @@ -36036,7 +36142,7 @@ part in the file to find a new address (or list of addresses). The &%no_more%& setting ensures that if the lookup fails (leading to &%data%& being an empty string), Exim gives up on the address without trying any subsequent routers. -This one router can handle all the virtual domains because the alias file names +This one router can handle all the virtual domains because the alias filenames follow a fixed pattern. Permissions can be arranged so that appropriate people can edit the different alias files. A successful aliasing operation results in a new envelope recipient address, which is then routed from scratch. @@ -36186,7 +36292,7 @@ Nevertheless there are some features that can be used. .section "Exim on the upstream server host" "SECID247" It is tempting to arrange for incoming mail for the intermittently connected -host to remain on Exim's queue until the client connects. However, this +host to remain in Exim's queue until the client connects. However, this approach does not scale very well. Two different kinds of waiting message are being mixed up in the same queue &-- those that cannot be delivered because of some temporary problem, and those that are waiting for their destination host @@ -36443,14 +36549,14 @@ need to tweak syslog to prevent it syncing the file with each write &-- on Linux this has been seen to make syslog take 90% plus of CPU time. The destination for Exim's logs is configured by setting LOG_FILE_PATH in -&_Local/Makefile_& or by setting &%log_file_path%& in the run time +&_Local/Makefile_& or by setting &%log_file_path%& in the runtime configuration. This latter string is expanded, so it can contain, for example, references to the host name: .code log_file_path = /var/log/$primary_hostname/exim_%slog .endd It is generally advisable, however, to set the string in &_Local/Makefile_& -rather than at run time, because then the setting is available right from the +rather than at runtime, because then the setting is available right from the start of Exim's execution. Otherwise, if there's something it wants to log before it has read the configuration file (for example, an error in the configuration file) it will not use the path you want, and may not be able to @@ -36473,11 +36579,11 @@ equivalent to the setting: .code log_file_path = $spool_directory/log/%slog .endd -If you do not specify anything at build time or run time, -or if you unset the option at run time (i.e. &`log_file_path = `&), +If you do not specify anything at build time or runtime, +or if you unset the option at runtime (i.e. &`log_file_path = `&), that is where the logs are written. -A log file path may also contain &`%D`& or &`%M`& if datestamped log file names +A log file path may also contain &`%D`& or &`%M`& if datestamped log filenames are in use &-- see section &<<SECTdatlogfil>>& below. Here are some examples of possible settings: @@ -37150,7 +37256,7 @@ client's ident port times out. &%incoming_interface%&: The interface on which a message was received is added to the &"<="& line as an IP address in square brackets, tagged by I= and followed by a colon and the port number. The local interface and port are also -added to other SMTP log lines, for example &"SMTP connection from"&, to +added to other SMTP log lines, for example, &"SMTP connection from"&, to rejection lines, and (despite the name) to outgoing &"=>"& and &"->"& lines. The latter can be disabled by turning off the &%outgoing_interface%& option. .next @@ -37211,7 +37317,6 @@ local port is a random ephemeral port. &%pid%&: The current process id is added to every log line, in square brackets, immediately after the time and date. .next -.new .cindex log pipelining .cindex pipelining "logging outgoing" &%pipelining%&: A field is added to delivery and accept @@ -37608,7 +37713,7 @@ There is one more option, &%-h%&, which outputs a list of options. .cindex "&'exiqsumm'&" .cindex "queue" "summary" The &'exiqsumm'& utility is a Perl script which reads the output of &`exim --bp`& and produces a summary of the messages on the queue. Thus, you use it by +-bp`& and produces a summary of the messages in the queue. Thus, you use it by running a command such as .code exim -bp | exiqsumm @@ -37655,11 +37760,11 @@ included in &'exigrep'&'s output without any additional lines. The usage is: .display &`exigrep [-t<`&&'n'&&`>] [-I] [-l] [-M] [-v] <`&&'pattern'&&`> [<`&&'log file'&&`>] ...`& .endd -If no log file names are given on the command line, the standard input is read. +If no log filenames are given on the command line, the standard input is read. The &%-t%& argument specifies a number of seconds. It adds an additional condition for message selection. Messages that are complete are shown only if -they spent more than <&'n'&> seconds on the queue. +they spent more than <&'n'&> seconds in the queue. By default, &'exigrep'& does case-insensitive matching. The &%-I%& option makes it case-sensitive. This may give a performance improvement when searching @@ -37722,8 +37827,8 @@ overriding the script's default, which is to find the setting from Exim's configuration. .endlist -Each time &'exicyclog'& is run the file names get &"shuffled down"& by one. If -the main log file name is &_mainlog_& (the default) then when &'exicyclog'& is +Each time &'exicyclog'& is run the filenames get &"shuffled down"& by one. If +the main log filename is &_mainlog_& (the default) then when &'exicyclog'& is run &_mainlog_& becomes &_mainlog.01_&, the previous &_mainlog.01_& becomes &_mainlog.02_& and so on, up to the limit that is set in the script or by the &%-k%& option. Log files whose numbers exceed the limit are discarded. Reject @@ -37793,7 +37898,7 @@ least one address that failed. The remainder of the output is in sections that can be independently disabled or modified by various options. It consists of a summary of deliveries by transport, histograms of messages received and delivered per time interval -(default per hour), information about the time messages spent on the queue, +(default per hour), information about the time messages spent in the queue, a list of relayed messages, lists of the top fifty sending hosts, local senders, destination hosts, and destination local users by count and by volume, and a list of delivery errors that occurred. @@ -37876,9 +37981,9 @@ well. .cindex "USE_DB" If the native DB interface is in use (USE_DB is set in a compile-time -configuration file &-- this is common in free versions of Unix) the two file -names must be different, because in this mode the Berkeley DB functions create -a single output file using exactly the name given. For example, +configuration file &-- this is common in free versions of Unix) the two +filenames must be different, because in this mode the Berkeley DB functions +create a single output file using exactly the name given. For example, .code exim_dbmbuild /etc/aliases /etc/aliases.db .endd @@ -37890,7 +37995,7 @@ Unix), two files are used, with the suffixes &_.dir_& and &_.pag_&. In this environment, the suffixes are added to the second argument of &'exim_dbmbuild'&, so it can be the same as the first. This is also the case when the Berkeley functions are used in compatibility mode (though this is not -recommended), because in that case it adds a &_.db_& suffix to the file name. +recommended), because in that case it adds a &_.db_& suffix to the filename. If a duplicate key is encountered, the program outputs a warning, and when it finishes, its return code is 1 rather than zero, unless the &%-noduperr%& @@ -38146,7 +38251,7 @@ default is to create a lock file and also to use &[fcntl()]& locking on the mailbox, which is the same as Exim's default. The use of &%-flock%& or &%-fcntl%& requires that the file be writeable; the use of &%-lockfile%& requires that the directory containing the file be writeable. Locking by lock -file does not last for ever; Exim assumes that a lock file is expired if it is +file does not last forever; Exim assumes that a lock file is expired if it is more than 30 minutes old. The &%-mbx%& option can be used with either or both of &%-fcntl%& or @@ -38237,7 +38342,7 @@ Eximon*highlight: gray End .endd .cindex "admin user" -In order to see the contents of messages on the queue, and to operate on them, +In order to see the contents of messages in the queue, and to operate on them, &'eximon'& must either be run as root or by an admin user. The command-line parameters of &'eximon'& are passed to &_eximon.bin_& and may @@ -38257,7 +38362,7 @@ different parts of the display. .section "The stripcharts" "SECID265" .cindex "stripchart" -The first stripchart is always a count of messages on the queue. Its name can +The first stripchart is always a count of messages in the queue. Its name can be configured by setting QUEUE_STRIPCHART_NAME in the &_Local/eximon.conf_& file. The remaining stripcharts are defined in the configuration script by regular expression matches on log file entries, making @@ -38373,7 +38478,7 @@ window. .section "The queue display" "SECID268" .cindex "queue" "display in monitor" The bottom section of the monitor window contains a list of all messages that -are on the queue, which includes those currently being received or delivered, +are in the queue, which includes those currently being received or delivered, as well as those awaiting delivery. The size of this subwindow is controlled by parameters in the configuration file &_Local/eximon.conf_&, and the frequency at which it is updated is controlled by another parameter in the same file &-- @@ -38382,7 +38487,7 @@ there is an &"Update"& action button just above the display which can be used to force an update of the queue display at any time. When a host is down for some time, a lot of pending mail can build up for it, -and this can make it hard to deal with other messages on the queue. To help +and this can make it hard to deal with other messages in the queue. To help with this situation there is a button next to &"Update"& called &"Hide"&. If pressed, a dialogue box called &"Hide addresses ending with"& is put up. If you type anything in here and press &"Return"&, the text is added to a chain of @@ -38403,7 +38508,7 @@ queue display to use in the dialogue box, you have to do the cutting before pressing the &"Hide"& button. The queue display contains, for each unhidden queued message, the length of -time it has been on the queue, the size of the message, the message id, the +time it has been in the queue, the size of the message, the message id, the message sender, and the first undelivered recipient, all on one line. If it is a bounce message, the sender is shown as &"<>"&. If there is more than one recipient to which the message has not yet been delivered, subsequent ones are @@ -38451,7 +38556,7 @@ information and headers is displayed in a new text window. See chapter &'body'&: The contents of the spool file containing the body of the message are displayed in a new text window. There is a default limit of 20,000 bytes to the amount of data displayed. This can be changed by setting the BODY_MAX -option at compile time, or the EXIMON_BODY_MAX option at run time. +option at compile time, or the EXIMON_BODY_MAX option at runtime. .next &'deliver message'&: A call to Exim is made using the &%-M%& option to request delivery of the message. This causes an automatic thaw if the message is @@ -38557,9 +38662,9 @@ penetrated the Exim (but not the root) account. These options are as follows: .ilist ALT_CONFIG_PREFIX can be set to a string that is required to match the -start of any file names used with the &%-C%& option. When it is set, these file -names are also not allowed to contain the sequence &"/../"&. (However, if the -value of the &%-C%& option is identical to the value of CONFIGURE_FILE in +start of any filenames used with the &%-C%& option. When it is set, these +filenames are also not allowed to contain the sequence &"/../"&. (However, if +the value of the &%-C%& option is identical to the value of CONFIGURE_FILE in &_Local/Makefile_&, Exim ignores &%-C%& and proceeds as usual.) There is no default setting for &%ALT_CONFIG_PREFIX%&. @@ -38626,7 +38731,7 @@ receiving messages and delivering them externally over SMTP, and it is obviously more secure if Exim does not run as root except when necessary. For this reason, a user and group for Exim to use must be defined in &_Local/Makefile_&. These are known as &"the Exim user"& and &"the Exim -group"&. Their values can be changed by the run time configuration, though this +group"&. Their values can be changed by the runtime configuration, though this is not recommended. Often a user called &'exim'& is used, but some sites use &'mail'& or another user name altogether. @@ -39040,11 +39145,9 @@ two files contains the final component of its own name as its first line. This is insurance against disk crashes where the directory is lost but the files themselves are recoverable. -.new The file formats may be changed, or new formats added, at any release. Spool files are not intended as an interface to other programs and should not be used as such. -.wen Some people are tempted into editing -D files in order to modify messages. You need to be extremely careful if you do this; it is not recommended and you are @@ -39591,7 +39694,6 @@ If a '+' prefix if used, all headers that are present with this name will be signed, and one signature added for a missing header with the name will be appended. -.new .option dkim_timestamps smtp integer&!! unset This option controls the inclusion of timestamp information in the signature. If not set, no such information will be included. @@ -39601,22 +39703,19 @@ for the expiry tag both creation (t=) and expiry (x=) tags will be included. RFC 6376 lists these tags as RECOMMENDED. -.wen .section "Verifying DKIM signatures in incoming mail" "SECDKIMVFY" .cindex "DKIM" "verification" -.new Verification of DKIM signatures in SMTP incoming email is done for all messages for which an ACL control &%dkim_disable_verify%& has not been set. .cindex authentication "expansion item" Performing verification sets up information used by the &$authresults$& expansion item. -.wen -.new The results of that verification are then made available to the -&%acl_smtp_dkim%& ACL, &new(which can examine and modify them). +The results of that verification are then made available to the +&%acl_smtp_dkim%& ACL, which can examine and modify them. By default, this ACL is called once for each syntactically(!) correct signature in the incoming message. A missing ACL definition defaults to accept. @@ -39624,7 +39723,7 @@ If any ACL call does not accept, the message is not accepted. If a cutthrough delivery was in progress for the message, that is summarily dropped (having wasted the transmission effort). -To evaluate the &new(verification result) in the ACL +To evaluate the verification result in the ACL a large number of expansion variables containing the signature status and its details are set up during the runtime of the ACL. @@ -39786,12 +39885,10 @@ strict enforcement should code the check explicitly. The number of signed body bytes. If zero ("0"), the body is unsigned. If no limit was set by the signer, "9999999999999" is returned. This makes sure that this variable always expands to an integer value. -.new &*Note:*& The presence of the signature tag specifying a signing body length is one possible route to spoofing of valid DKIM signatures. A paranoid implementation might wish to regard signature where this variable shows less than the "no limit" return as being invalid. -.wen .vitem &%$dkim_created%& UNIX timestamp reflecting the date and time when the signature was created. @@ -40281,11 +40378,9 @@ If a value is appended it may be: If mua_wrapper is set, the utf8_downconvert control is initially set to -1. -.new The smtp transport has an option &%utf8_downconvert%&. If set it must expand to one of the three values described above, and it overrides any previously set value. -.wen There is no explicit support for VRFY and EXPN. @@ -40493,6 +40588,9 @@ Edit &_Makefile_& in the appropriate sub-directory (&_src/routers_&, &_src/transports_&, &_src/auths_&, or &_src/lookups_&); add a line for the new driver or lookup type and add it to the definition of OBJ. .next +Edit &_OS/Makefile-Base_& adding a &_.o_& file for the predefined-macros, to the +definition of OBJ_MACRO. Add a set of line to do the compile also. +.next Create &_newdriver.h_& and &_newdriver.c_& in the appropriate sub-directory of &_src_&. .next diff --git a/doc/doc-misc/Ext-mbx-locking b/doc/doc-misc/Ext-mbx-locking index 9ef684026..30a547f63 100644 --- a/doc/doc-misc/Ext-mbx-locking +++ b/doc/doc-misc/Ext-mbx-locking @@ -228,7 +228,7 @@ BEZERK AND MMDF Locking in the traditional UNIX formats was largely dictated by the status quo in other applications; however, additional protection -is added against inadvertantly running multiple instances of a +is added against inadvertently running multiple instances of a c-client application on the same mail file. (1) c-client attempts to create a .lock file (mail file name with diff --git a/doc/doc-src/FAQ.src b/doc/doc-src/FAQ.src index 47b810e5d..e9b865c91 100644 --- a/doc/doc-src/FAQ.src +++ b/doc/doc-src/FAQ.src @@ -408,7 +408,7 @@ A0018: Recall that Exim does not keep separate queues for each domain, but a temporary error. Here are some possibilities: (1) The messages to \(aol.com)\ got put in your queue, but no previous - delivery attempt occured before you did the \-R-\. This might have been + delivery attempt occurred before you did the \-R-\. This might have been because of your settings of \queue_only_load\, \smtp_accept_queue\, or any other option that caused no immediate delivery attempt on arrival. If this is the case, you can try using \-qqR-\ instead of \-R-\. @@ -1538,7 +1538,7 @@ A0089: This was a bad interaction between a change to the Linux kernel and some taken from Exim's change log: When Exim is receiving multiple messages on a single connection, and - spinning off delivery processess, it sets the SIGCHLD signal handling to + spinning off delivery processes, it sets the SIGCHLD signal handling to SIG_IGN, because it doesn't want to wait for these processes. However, because on some OS this didn't work, it also has a paranoid call to \^waitpid()^\ in the loop to reap any children that have finished. Some @@ -1862,7 +1862,7 @@ A0117: Here! This is a contribution from a RedHat user, somewhat edited. On ==> adduser exim (3) Now you can prepare to build Exim. Go to \?https://www.exim.org?\ or - one of its mirrors, or the master ftp site + one of its mirrors, or the master FTP site \?ftp://ftp.csx.cam.ac.uk/pub/software/email/exim/exim4?\, and download \(exim-4.20.tar.gz)\ or whatever the current release is. Then: @@ -2917,7 +2917,7 @@ Q0419: I have some obsolete domains which people have been warned not to use any more. How can I arrange to delete any mail that is sent to them? A0419: To reject them at SMTP time, with a customized error message, place - statments like this in the ACL: + statements like this in the ACL: ==> deny message = The domain $domain is obsolete domains = lsearch;/etc/exim/obsolete.domains @@ -5122,7 +5122,7 @@ A1001: Splitting the spool directory has most benefit if there are times when up earlier on some types of file system, compared with others. Exim was not designed for handling large queues. If you are in an - enviroment where lots of messages remain on the queue for long periods + environment where lots of messages remain on the queue for long periods of time, consider implementing a back up host to which you pass these messages, so that the main host's queue remains short. You can use \fallback_hosts\ to do this, or a router that is conditional on @@ -6544,7 +6544,7 @@ Q9604: I get the \*too many open files*\ error especially when a lot of messages land for Majordomo at the same time. A9604: The problem appears to be the number of open files the system can - handle. This is changable by using the proc filesystem. To your + handle. This is changeable by using the proc filesystem. To your \(/etc/rc.d/rc.local)\ file append something like the following: ==> # Now System is up, Modify kernel parameters for max open etc. @@ -7026,7 +7026,7 @@ Samples whose names are of the form Cnnn are Exim configurations; those with names of the form Fnnn are filter file fragments; those with names of the form Lnnn are sample \^^local_scan()^^\ functions, and those with names of thf form Snnn are scripts of various kinds. There are other examples of -\^^local_scan()^^\ functions at a number of web sites (for example, +\^^local_scan()^^\ functions at a number of websites (for example, \?http://marc.merlins.org/linux/exim/sa.html?\). There are gaps in the C and F numbers because I have omitted the Exim 3 samples diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index d5984e7b2..9313c7b28 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -191,8 +191,26 @@ JH/37 Bug 2341: Send "message delayed" warning MDNs (restricted to external and multiple senders' messages were queued, only one sender would get notified on each configured delay_warning cycle. -AM/01 Bug 2359: GnuTLS: repeat lowlevel read and write operations while they return error - codes indicating retry. Under TLS1.3 this becomes required. +JH/38 Bug 2351: Log failures to extract envelope addresses from message headers. + +JH/39 OpenSSL: clear the error stack after an SSL_accept(). With anon-auth + cipher-suites, an error can be left on the stack even for a succeeding + accept; this results in impossible error messages when a later operation + actually does fail. + +AM/01 Bug 2359: GnuTLS: repeat lowlevel read and write operations while they + return error codes indicating retry. Under TLS1.3 this becomes required. + +JH/40 Fix the feature-cache refresh for EXPERIMENTAL_PIPE_CONNECT. Previously + it only wrote the new authenticators, resulting in a lack of tracking of + peer changes of ESMTP extensions until the next cache flush. + +JH/41 Fix the loop reading a message header line to check for integer overflow, + and more-often against header_maxsize. Previously a crafted message could + induce a crash of the recive process; now the message is cleanly rejected. + +JH/42 Bug 2366: Fix the behaviour of the dkim_verify_signers option. It had + been totally disabled for all of 4.91. Discovery and fix by "Mad Alex". Exim version 4.91 diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff index ac0254ffa..ad238f4c7 100644 --- a/doc/doc-txt/NewStuff +++ b/doc/doc-txt/NewStuff @@ -6,8 +6,8 @@ Before a formal release, there may be quite a lot of detail so that people can test from the snapshots or the Git before the documentation is updated. Once the documentation is updated, this file is reduced to a short list. -Version 4.92 --------------- +Version 4.93 +------------ 1. An "external" authenticator, per RFC 4422 Appendix A. @@ -960,7 +960,7 @@ Version 4.68 longest line that was received as part of the message, not counting the line termination character(s). - 7. Host lists can now include +ignore_defer and +include_defer, analagous to + 7. Host lists can now include +ignore_defer and +include_defer, analogous to +ignore_unknown and +include_unknown. These options should be used with care, probably only in non-critical host lists such as whitelists. diff --git a/doc/doc-txt/OptionLists.txt b/doc/doc-txt/OptionLists.txt index 5586e7d34..069a787d6 100644 --- a/doc/doc-txt/OptionLists.txt +++ b/doc/doc-txt/OptionLists.txt @@ -500,6 +500,8 @@ server_mail_auth_condition string* unset authenticator server_mech string public_name cyrus_sasl,gsasl 4.43 (cyrus-only) 4.80 (others) server_password string unset gsasl 4.80 server_param1 string* unset tls (auth) 4.86 +server_param2 string* unset tls (auth) 4.86 +server_param3 string* unset tls (auth) 4.86 server_param2 string* unset tls (auth) 4.86 (tls-only) 4.93 (external) server_param3 string* unset tls (auth) 4.86 (tls-only) 4.93 (external) server_prompts string* unset plaintext 3.10 diff --git a/doc/doc-txt/dbm.discuss.txt b/doc/doc-txt/dbm.discuss.txt index 4de57735e..7df044e82 100644 --- a/doc/doc-txt/dbm.discuss.txt +++ b/doc/doc-txt/dbm.discuss.txt @@ -223,7 +223,7 @@ files in other formats that are created by other programs. Berkeley DB 4.x --------------- -The 4.x series is a developement of the 2.x and 3.x series, and the above +The 4.x series is a development of the 2.x and 3.x series, and the above comments apply. diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt index d5a75f5b3..84fd54716 100644 --- a/doc/doc-txt/experimental-spec.txt +++ b/doc/doc-txt/experimental-spec.txt @@ -940,7 +940,7 @@ EHLO,STARTTLS -> TLS1.2-client-hello -> <- TLS-server-hello,cert,hello-done client-Kex,change-cipher,finished -> - <- change-cipher,finshed + <- change-cipher,finished EHLO,MAIL,RCPT,DATA -> <- EHLO-resp,MAIL-ack,RCPT-ack,DATA-goahead diff --git a/release-process/scripts/mk_exim_release b/release-process/scripts/mk_exim_release index 6e4767bd2..dd443aee0 100755 --- a/release-process/scripts/mk_exim_release +++ b/release-process/scripts/mk_exim_release @@ -1,417 +1,500 @@ #!/usr/bin/env perl -# Copyright (c) The Exim Maintainers 2016 +# Copyright (c) The Exim Maintainers 2016-2018 use strict; use warnings; use Carp; -use File::Copy; -use File::Spec; -use File::Path; +use Cwd qw'abs_path'; +use File::Basename; +use File::Path qw(make_path remove_tree); use File::Temp; -use FindBin; use Getopt::Long; use IO::File; use Pod::Usage; +use Digest::SHA; +use if $ENV{DEBUG} => 'Smart::Comments'; + +my $ME = basename $0; + my $debug = 0; my $verbose = 0; -# ------------------------------------------------------------------ +# MAJOR.MINOR[.SECURITY[.FIXES]][-RCX] +# 4 .90 .0 .22 -RC1 +my $version_pattern = qr/ + (?<release> + (?<major>\d) # 4 + \.(?<minor>\d\d) # .90 + (?:\.(?<security>\d+) # .0 + (?:\.(?<fixes>)\d+)?)? # .22 + (?:-(?<rc>RC\d+)?)? # -RC1 + ) +/x; -sub get_and_check_version { - my $release = shift; - my $context = shift; +# ------------------------------------------------------------------ - # make sure this looks like a real release version - # which should (currently) be 4.xx[.y] or 4.xx[.y]_RCx - unless ( $release =~ /^(?<release>(?<major>4\.\d\d)(?:\.(?<minor>\d+))?(?<rc>_RC\d+)?)$/ ) { - croak "The given version number does not look right - $release"; +package Context { + use strict; # not strictly necessary yet, until in an own package + use warnings; # not strictly necessary yet, ... + use File::Spec::Functions qw'splitpath catfile catdir splitdir'; + use File::Path qw'make_path remove_tree'; + use File::Copy; + use Cwd qw'abs_path'; + use Carp; + + package PWD { + use Cwd; + sub TIESCALAR { bless do {\my $x} } + sub FETCH { cwd } } - $context->{release} = $+{release}; - $context->{major} = $+{major}; - $context->{minor} = $+{minor}; - $context->{candidatev} = $+{rc}; - ($context->{trelease} = $+{release}) =~ s/_RC\d+//; -} + tie my $cwd => 'PWD' or die; -# ------------------------------------------------------------------ + sub new { + my $class = shift; + return bless { @_ } => $class; + } -sub build_tag { - my $context = shift; + sub check_version { + my $context = shift; + my $version = shift; - # The CVS tag consists of exim-$version where $version - # is the version number with . replaced with _ - my $modversion = $context->{release}; - $modversion =~ tr/0-9RC/_/cs; + croak "The given version number does not look right - $version" + if not $version =~ /$version_pattern/; - return sprintf( 'exim-%s', $modversion ); -} + $context->{v}{release} = $+{release}; + $context->{v}{major} = $+{major}; + $context->{v}{minor} = $+{minor}; + $context->{v}{security} = $+{security}; + $context->{v}{rc} = $+{rc}; -# ------------------------------------------------------------------ + die "$ME: This script doesn't work for versions prior 4.92-RCx. " + ."Please checkout an older version.\n" + if $context->{v}{major} < 4 + or $context->{v}{major} == 4 && $context->{v}{minor} < 92; -sub deal_with_working_directory { - my $context = shift; - my $delete = shift; + ### v: $context->{v} - # Set default directory - $context->{directory} ||= File::Spec->rel2abs( sprintf( 'exim-packaging-%s', $context->{release} ) ); - my $directory = $context->{directory}; + # find a valid vcs tag matching the version + my $pattern = "$context->{pkgname}-$context->{v}{release}" =~ s/[-_.]/[-_.]/gr; + chomp(my @tags = qx{git tag --list '$pattern'}); - # ensure the working directory is not in place - if ( -d $directory ) { - if ($delete) { - print "Deleting existing $directory\n" if ($verbose); - rmtree( $directory, { verbose => $debug } ); - } - if ( -d $directory ) { - croak "Working directory $directory exists"; - } - } + croak "The given version is ambigous, tags: @tags\n" if @tags > 1; + croak "The given version does not exist (no such tag: exim-$version)\n" if @tags == 0; - # create base directory - mkpath( $context->{directory}, { verbose => ( $verbose || $debug ) } ); + $context->{git_tag} = $tags[0]; - # set and create subdirectories - foreach (qw(release_tree pkgs pkgdirs docbook tmp)) { - $context->{$_} = File::Spec->catdir( $context->{directory}, $_ ); - mkpath( $context->{$_}, { verbose => ( $verbose || $debug ) } ); + # target_release: the release we aim to reach with release candidates + # FIXME: re-construct from the parsed version number + ($context->{v}{target_release} = $context->{v}{release}) =~ s/-RC\d+//; } -} -# ------------------------------------------------------------------ -sub export_git_tree { - my $context = shift; + # We prefer gtar to tar if gtar exists in $PATH + sub override_tar_cmd { + my $context = shift; + my $tar = $context->{tar_cmd}; - # build git command - my $archive_file = sprintf( '%s/%s-%s.tar', $context->{tmp}, $context->{pkgname}, $context->{release} ); - $context->{tmp_archive_file} = $archive_file; - my @cmd = ( 'git', 'archive', '--format=tar', "--output=$archive_file", $context->{tag} ); - # run git command - print( "Running: ", join( ' ', @cmd ), "\n" ) if ($verbose); - system(@cmd) == 0 || croak "Export failed"; -} + return unless $tar eq 'tar'; -# ------------------------------------------------------------------ + foreach my $d (File::Spec->path()) { + my $p = catfile($d, 'gtar'); + if (-x $p) { + $context->{tar_cmd} = $p; + print "Switched tar command to: $p\n" if $verbose; + return; + } + } + } -sub unpack_tree { - my $context = shift; + sub prepare_working_directory { + my $context = shift; + my $workspace = $context->{workspace}; - die "Cannot see archive file\n" unless ( -f $context->{tmp_archive_file} ); - my @cmd = ( 'tar', 'xf', $context->{tmp_archive_file}, '-C', $context->{release_tree} ); + if (not defined $workspace) { + $workspace = $context->{workspace} = File::Temp->newdir(File::Spec->tmpdir . '/exim-packaging-XXXX'); + } + else { + # ensure the working directory is not in place + if (-e $workspace) { + if ($context->{delete}) { + print "Deleting existing $workspace\n" if $verbose; + remove_tree $workspace, { verbose => $verbose || $debug }; + } + else { + croak "Working directory $workspace exists" if -e $workspace; + } + } + + # create base directory + make_path( $context->{directory}, { verbose => $verbose || $debug } ); + } - # run command - print( "Running: ", join( ' ', @cmd ), "\n" ) if ($verbose); - system(@cmd) == 0 || croak "Unpack failed"; -} + # Set(!) and create subdirectories + foreach (qw(vcs_export pkg_tars pkg_trees tmp)) { # {dookbook} + make_path( + $context->{d}{$_} = catdir($workspace, $_), + { verbose => $verbose || $debug }); + } + } -# ------------------------------------------------------------------ + sub export_git_tree { + my $context = shift; + + # build git command + my $archive_file = $context->{tmp_archive_file} = sprintf'%s/%s-%s.tar', $context->{d}{tmp}, $context->{pkgname}, $context->{v}{release}; + ### $archive_file + my @cmd = ( 'git', 'archive', '--format=tar', "--output=$archive_file", $context->{git_tag} ); + ### @cmd + # run git command + print "[$cwd] Running: @cmd\n" if $verbose; + 0 == system @cmd or croak "Export failed"; + } -sub make_version_script { - my $context = shift; + sub unpack_tree { + # TODO: Why can't we combine the export_git_tree with the + # unpack_tree function? + my $context = shift; - my $variant = substr( $context->{release}, length($context->{trelease}) ); - if ( $context->{release} ne $context->{trelease} . $variant ) { - die "Broken version numbering, I'm buggy"; - } + ### $context + die "Cannot see archive file\n" unless -f $context->{tmp_archive_file}; + my @cmd = ('tar', + xf => $context->{tmp_archive_file}, + -C => $context->{d}{vcs_export} ); - my $srcdir = File::Spec->catdir( $context->{release_tree}, 'src', 'src' ); - chdir $srcdir or die "chdir $srcdir: $!\n"; + # run command + print "[$cwd] Running: @cmd\n" if $verbose; + system @cmd and croak "Unpack failed\n"; - if ( -f "version.sh" ) { - print( "WARNING: version.sh already exists - leaving it in place\n" ); - return; } - # Currently (25. Feb. 2016) the mk_exim_release.pl up to now can't - # deal with security releases.!? So we need a current - # mk_exim_release.pl. But if we use a current (master), the - # reversion script returns wrong version info (it's running inside - # the Git tree and uses git --describe, which always returns the - # current version of master.) I do not want to change the old - # reversion scripts (in 4.86.1, 4.85.1). - # - # Thus we've to provide the version.sh, based on the info we have - # about the release. If reversion finds this, it doesn't try to find - # it's own way to get a valid version number from the git. - # - # 4.89 series: the logic here did not handle _RC<N> thus breaking RC - # status in versions. nb: candidatev in context should be same as $variant - # in local context. - my $stamp = $context->{minor} ? '_'.$context->{minor} : ''; - $stamp .= $context->{candidatev} if $context->{candidatev}; - # - open(my $v, '>', 'version.sh') or die "Can't open '>version.sh' $!\n"; - print {$v} <<__; -# initial version automatically generated from $0 -EXIM_RELEASE_VERSION=$context->{major} -EXIM_VARIANT_VERSION=$stamp + sub make_version_script { + my $context = shift; + + #my $variant = substr( $context->{v}{release}, length($context->{v}{target_release}) ); + #if ( $context->{v}{release} ne $context->{v}{target_release} . $variant ) { + # die "Broken version numbering, I'm buggy"; + #} + + + # Work + if (not my $pid = fork // die "$ME: Cannot fork: $!\n") { + + my $source_tree = catdir($context->{d}{vcs_export}, 'src', 'src'); + ### $source_tree + + chdir $source_tree or die "chdir $source_tree: $!\n"; + + + croak "WARNING: version.sh already exists - leaving it in place\n" + if -f 'version.sh'; + + # Currently (25. Feb. 2016) the mk_exim_release.pl up to now can't + # deal with security releases.!? So we need a current + # mk_exim_release.pl. But if we use a current (master), the + # reversion script returns wrong version info (it's running inside + # the Git tree and uses git --describe, which always returns the + # current version of master.) I do not want to change the old + # reversion scripts (in 4.86.1, 4.85.1). + # + # Thus we've to provide the version.sh, based on the info we have + # about the release. If reversion finds this, it doesn't try to find + # it's own way to get a valid version number from the git. + # + # 4.89 series: the logic here did not handle _RC<N> thus breaking RC + # status in versions. nb: rc in context should be same as $variant + # in local context. + + #my $stamp = $context->{minor} ? '_'.$context->{minor} : ''; + #$stamp .= $context->{rc} if $context->{rc}; + my $variant = $context->{v}{rc} // ''; + + print "[$cwd] create version.sh\n" if $verbose; + open(my $v, '>', 'version.sh') or die "Can't open version.sh for writing: $!\n"; + print {$v} <<__; +# initial version automatically generated by $0 +EXIM_RELEASE_VERSION=$context->{v}{target_release} +EXIM_VARIANT_VERSION=$variant EXIM_COMPILE_NUMBER=0 +# echo "[[[ \$EXIM_RELEASE_VERSION | \$EXIM_VARIANT_VERSION | \$EXIM_COMPILE_NUMBER ]]]" __ - close($v); - unlink 'version.h'; - return; + close $v or die "$0: Can not close $source_tree/version.h: $!\n"; + unlink 'version.h' or die "$ME: Can not unlink $source_tree/version.h: $!\n" + if -f 'version.h'; - # Later, if we get the reversion script fixed, we can call it again. - # For now (25. Feb. 2016) we'll leave it unused. - my @cmd = ("../scripts/reversion", "release", $context->{tag}); - print( "Running: ", join( ' ', @cmd ), "\n" ) if ($verbose); - system(@cmd) == 0 || croak "reversion failed"; + # Later, if we get the reversion script fixed, we can call it again. + # For now (25. Feb. 2016) we'll leave it unused. + #my @cmd = ('../scripts/reversion', 'release', $context->{git_tag}); - unlink "version.h"; + my @cmd = ('../scripts/reversion', 'release'); + print "[$cwd] Running: @cmd\n" if $verbose; + system(@cmd) and croak "reversion failed"; - -f "version.sh" or die "failed to create version.sh"; -} + die "$ME: failed to create version.sh" + unless -f 'version.sh'; -# ------------------------------------------------------------------ + exit 0; + } + else { + $pid == waitpid($pid, 0) or die "$0: waidpid: $!\n"; + exit $? >> 8 if $?; + } + } -sub build_html_documentation { - my $context = shift; + sub build_documentation { + my $context = shift; + my $docdir = catdir $context->{d}{vcs_export}, 'doc', 'doc-docbook'; + + # documentation building does a chdir, so we'll do it in a + # subprocess + if (not my $pid = fork // die "$ME: Can't fork: $!\n") { + chdir $docdir or die "$ME: Can't chdir to $docdir: $!\n"; + system('./OS-Fixups') == 0 or exit $?; + exec $context->{make_cmd}, + "EXIM_VER=$context->{v}{target_release}" . + ($context->{v}{rc} ? "-$context->{v}{rc}" : ''), + 'everything'; + die "$ME: [$cwd] Cannot exec $context->{make_cmd}: $!\n"; + } + else { + waitpid($pid, 0); + exit $? >> 8 if $?; + } - my $genpath = $context->{webgen_base} . '/script/gen.pl'; - my $templates = $context->{webgen_base} . '/templates'; - my $dir = File::Spec->catdir( $context->{release_tree}, 'html' ); - my $spec = File::Spec->catfile( $context->{docbook}, 'spec.xml' ); - my $filter = File::Spec->catfile( $context->{docbook}, 'filter.xml' ); + $context->copy_docbook_files; + } - mkdir($dir); + sub copy_docbook_files { + my $context = shift; - my @cmd = ( - $genpath, '--spec', $spec, '--filter', - $filter, '--latest', $context->{trelease}, '--tmpl', - $templates, '--docroot', $dir, '--localstatic' - ); - push @cmd, '--verbose' if $verbose or $debug; + # where the generated docbook files can be found + my $docdir = catdir $context->{d}{vcs_export}, 'doc', 'doc-docbook'; - print "Executing ", join( ' ', @cmd ), "\n"; - system(@cmd); + foreach ('spec.xml', 'filter.xml') { + my $from = catfile $docdir, $_; + my $to = catdir $context->{d}{tmp}; # {dookbook} + copy $from => $to or die $@; + } + } - # move directory into right place - my $sourcedir = File::Spec->catdir( $context->{docbook}, 'filter.xml' ); + sub build_html_documentation { + my $context = shift; - rename( - File::Spec->catdir( $dir, sprintf( 'exim-html-%s', $context->{trelease} ) ), - File::Spec->catdir( $context->{pkgdirs}, sprintf( 'exim-html-%s', $context->{release} ) ) - ); -} + # where the website docbook source dir is - push the generated + # files there + { + my $webdir = catdir $context->{website_base}, 'docbook', $context->{v}{target_release}; + make_path $webdir, { verbose => $verbose + $debug }; + copy catfile($context->{d}{vcs_export}, 'doc', 'doc-docbook', $_) + => $webdir or die $@ + for 'spec.xml', 'filter.xml'; + } -# ------------------------------------------------------------------ + my $gen = catfile $context->{website_base}, 'script/gen'; + my $outdir = catdir $context->{d}{pkg_trees}, "exim-html-$context->{v}{release}"; -sub copy_docbook_files { - my $context = shift; + make_path $outdir, { verbose => $verbose || $debug }; - # where the generated docbook files can be found - my $docdir = File::Spec->catdir( $context->{release_tree}, 'doc', 'doc-docbook' ); + my @cmd = ( + $gen, + '--spec' => catfile($context->{d}{tmp}, 'spec.xml'), # {dookbook} + '--filter' => catfile($context->{d}{tmp}, 'filter.xml'), # {dookbok} + '--latest' => $context->{v}{target_release}, + '--docroot' => $outdir, + '--localstatic', + ($verbose || $debug ? '--verbose' : ()), + ); - # where the website docbook source dir is - push files to here - my $webdir = File::Spec->catdir( $context->{webgen_base}, 'docbook', $context->{trelease} ); - mkpath( $webdir, { verbose => ( $verbose || $debug ) } ); + print "[$cwd] Executing @cmd\n"; + 0 == system @cmd or exit $? >> 8; - foreach my $file ( 'spec.xml', 'filter.xml' ) { - my $from = File::Spec->catfile( $docdir, $file ); - my $to = File::Spec->catfile( $context->{docbook}, $file ); - my $webto = File::Spec->catfile( $webdir, $file ); - copy( $from, $to ); - copy( $from, $webto ); } -} -# ------------------------------------------------------------------ - -sub build_documentation { - my $context = shift; - - my $docdir = File::Spec->catdir( $context->{release_tree}, 'doc', 'doc-docbook' ); - # documentation building gets the truncated release, without RC - system("cd '$docdir' && ./OS-Fixups && $context->{make_cmd} EXIM_VER=$context->{trelease} everything") == 0 - || croak "Doc build failed"; + sub sign { + my $context = shift; + foreach my $tar (glob "$context->{d}{pkg_tars}/*") { + system gpg => + '--quiet', '--batch', + defined $context->{gpg}{key} + ? ('--local-user' => $context->{gpg}{key}) + : (), + '--detach-sig', '--armor', $tar; + } + } - copy_docbook_files($context); - build_html_documentation($context) if $context->{web}; -} + sub move_to_outdir { + my $context = shift; + make_path $context->{OUTDIR}, { verbose => $verbose || $debug }; + move $_ => $context->{OUTDIR} or die $@ + for glob "$context->{d}{pkg_tars}/*"; + } -# ------------------------------------------------------------------ + sub build_src_package_directory { + my $context = shift; -sub move_text_docs_into_pkg { - my $context = shift; + # build the exim package directory path + $context->{d}{src} = catdir $context->{d}{pkg_trees}, "exim-$context->{v}{release}"; - my $old_docdir = File::Spec->catdir( $context->{release_tree}, 'doc', 'doc-docbook' ); - my $old_txtdir = File::Spec->catdir( $context->{release_tree}, 'doc', 'doc-txt' ); - my $new_docdir = File::Spec->catdir( $context->{eximpkgdir}, 'doc' ); - mkpath( $new_docdir, { verbose => ( $verbose || $debug ) } ); + # initially we move the exim-src directory to the new directory name + move + catdir( $context->{d}{vcs_export}, 'src') + => $context->{d}{src} + or croak "Move of src dir failed - $!"; - # move generated documents from docbook stuff - foreach my $file (qw/exim.8 spec.txt filter.txt/) { - die "Empty file \"$file\"\n" if -z File::Spec->catfile( $old_docdir, $file ); - move( File::Spec->catfile( $old_docdir, $file ), File::Spec->catfile( $new_docdir, $file ) ); - } + # add Local subdirectory + make_path( catdir( $context->{d}{src}, 'Local' ), { verbose => $verbose || $debug } ); - # move text documents across - foreach my $file ( glob( File::Spec->catfile( $old_txtdir, '*' ) ) ) { - - # skip a few we dont want - my $fn = ( File::Spec->splitpath($file) )[2]; - next - if ( ( $fn eq 'ABOUT' ) - || ( $fn eq 'ChangeLog.0' ) - || ( $fn eq 'test-harness.txt' ) - # Debian issue re licensing of RFCs - || ( $fn =~ /^draft-ietf-.*/ ) - || ( $fn =~ /^rfc.*/ ) - ); - move( $file, File::Spec->catfile( $new_docdir, $fn ) ); + # now add the text docs + $context->move_text_docs_into_pkg; } -} - -# ------------------------------------------------------------------ -sub build_pspdfinfo_directory { - my $context = shift; - - ##foreach my $format (qw/pdf postscript texinfo info/) { - foreach my $format (qw/pdf postscript/) { - my $target = File::Spec->catdir( $context->{pkgdirs}, sprintf( 'exim-%s-%s', $format, $context->{release} ), 'doc' ); - mkpath( $target, { verbose => ( $verbose || $debug ) } ); - - # move documents across - foreach my $file ( - glob( - File::Spec->catfile( - $context->{release_tree}, - 'doc', - 'doc-docbook', - ( - ( $format eq 'postscript' ) - ? '*.ps' - : ( '*.' . $format ) + sub build_doc_packages_directory { + my $context = shift; + + ##foreach my $format (qw/pdf postscript texinfo info/) { + foreach my $format (qw/pdf postscript/) { + my $target = catdir $context->{d}{pkg_trees}, "exim-$format-$context->{v}{release}", 'doc'; + make_path( $target, { verbose => $verbose || $debug } ); + + # move documents across + foreach my $file ( + glob( + catfile( + $context->{d}{vcs_export}, + 'doc', + 'doc-docbook', + ( + ( $format eq 'postscript' ) + ? '*.ps' + : ( '*.' . $format ) + ) ) ) ) - ) - { - move( $file, File::Spec->catfile( $target, ( File::Spec->splitpath($file) )[2] ) ); + { + move( $file, catfile( $target, ( splitpath($file) )[2] ) ); + } } } -} - -# ------------------------------------------------------------------ - -sub build_main_package_directory { - my $context = shift; - - # build the exim package directory path - $context->{eximpkgdir} = File::Spec->catdir( $context->{pkgdirs}, sprintf( 'exim-%s', $context->{release} ) ); - - # initially we move the exim-src directory to the new directory name - rename( File::Spec->catdir( $context->{release_tree}, 'src' ), $context->{eximpkgdir} ) - || croak "Rename of src dir failed - $!"; - # add Local subdirectory - mkpath( File::Spec->catdir( $context->{eximpkgdir}, 'Local' ), { verbose => ( $verbose || $debug ) } ); - - # now add the text docs - move_text_docs_into_pkg($context); -} - -# ------------------------------------------------------------------ + sub move_text_docs_into_pkg { + my $context = shift; -sub build_package_directories { - my $context = shift; - - build_main_package_directory($context); - build_pspdfinfo_directory($context) if $context->{build_docs}; -} - -# ------------------------------------------------------------------ - -sub do_cleanup { - my $context = shift; - - print "Cleaning up\n" if ($verbose); - chdir( $context->{directory} ) || die; - rmtree( $context->{release_tree}, { verbose => $debug } ); - rmtree( $context->{docbook}, { verbose => $debug } ); - rmtree( $context->{pkgdirs}, { verbose => $debug } ); -} + my $old_docdir = catdir( $context->{d}{vcs_export}, 'doc', 'doc-docbook' ); + my $old_txtdir = catdir( $context->{d}{vcs_export}, 'doc', 'doc-txt' ); + my $new_docdir = catdir( $context->{d}{src}, 'doc' ); + make_path( $new_docdir, { verbose => $verbose || $debug } ); -# ------------------------------------------------------------------ - -# We prefer gtar to tar if gtar exists in $PATH - -sub fix_paths_tar { - my $context = shift; - my $tar = $context->{tar_cmd}; - - return unless $tar eq 'tar'; + # move generated documents from docbook stuff + foreach my $file (qw/exim.8 spec.txt filter.txt/) { + die "Empty file \"$file\"\n" if -z catfile( $old_docdir, $file ); + move( catfile( $old_docdir, $file ), catfile( $new_docdir, $file ) ); + } - foreach my $d (File::Spec->path()) { - my $p = File::Spec->catfile($d, 'gtar'); - if (-x $p) { - $context->{tar_cmd} = $p; - print "Switched tar command to: $p\n" if ($verbose); - return; + # move text documents across + foreach my $file ( glob( catfile( $old_txtdir, '*' ) ) ) { + + # skip a few we dont want + my $fn = ( splitpath($file) )[2]; + next + if ( ( $fn eq 'ABOUT' ) + || ( $fn eq 'ChangeLog.0' ) + || ( $fn eq 'test-harness.txt' ) + # Debian issue re licensing of RFCs + || ( $fn =~ /^draft-ietf-.*/ ) + || ( $fn =~ /^rfc.*/ ) + ); + move( $file, catfile( $new_docdir, $fn ) ); } } -} -# ------------------------------------------------------------------ + sub create_tar_files { + my $context = shift; -sub create_tar_files { - my $context = shift; + my $pkg_tars = $context->{d}{pkg_tars}; + my $pkg_trees = $context->{d}{pkg_trees}; + my $tar = $context->{tar_cmd}; + if ($verbose) { + foreach my $c (keys %{ $context->{compressors} }) { + print "Compression: $c\t$context->{compressors}{$c}\n"; + } + } - my $pkgs = $context->{pkgs}; - my $pkgdirs = $context->{pkgdirs}; - my $tar = $context->{tar_cmd}; - if ($verbose) { - foreach my $c (keys %{ $context->{compressors} }) { - print "Compression: $c\t$context->{compressors}{$c}\n"; + # We ideally do not want local system user information in release tarballs; + # those are artifacts of use of tar for backups and have no place in + # software release packaging; if someone extracts as root, then they should + # get sane file ownerships. + my @ownership = ( + '--owner' => $context->{tar_perms}{user}, + '--group' => $context->{tar_perms}{group}, + # on this GNU tar, --numeric-owner works during creation too + '--numeric-owner' + ) if qx/tar --help 2>&1/ =~ /^\s*--owner=/m; + + # See also environment variables set in main, tuning compression levels + my %COMPRESSION = ( + gzip => { extension => 'gz', flags => '--gzip' }, + bzip2 => { extension => 'bz2', flags => '--bzip2' }, + lzip => { extension => 'lz', flags => '--lzip' }, + xz => { extension => 'xz', flags => '--xz' }, + ); + + + my (%size, %sha256); + + foreach my $dir ( glob( catdir( $pkg_trees, ( 'exim*-' . $context->{v}{release} ) ) ) ) { + my $dirname = ( splitdir($dir) )[-1]; + foreach my $comp (keys %COMPRESSION) { + next unless $context->{compressors}{$comp}; + + my $basename = "$dirname.tar.$COMPRESSION{$comp}{extension}"; + my $outfile = catfile $pkg_tars, $basename; + + print "Creating: $outfile\n" if $verbose || $debug; + 0 == system($tar, + cf => $outfile, + $COMPRESSION{$comp}{flags}, + @ownership, -C => $pkg_trees, $dirname) + or exit $? >> 8; + + # calculate size and md5sum + $size{$basename} = -s $outfile; + $sha256{$basename} = do { + my $sha = Digest::SHA->new(256); + $sha->addfile($outfile); + $sha->hexdigest; + }; + } } - } - # We ideally do not want local system user information in release tarballs; - # those are artifacts of use of tar for backups and have no place in - # software release packaging; if someone extracts as root, then they should - # get sane file ownerships. - my $ownership = ""; - if (`tar --help 2>&1` =~ /^\s*--owner=/m) { - $ownership .= " --owner=$context->{tar_perms}{user} --group=$context->{tar_perms}{group}"; - # on this GNU tar, --numeric-owner works during creation too - $ownership .= " --numeric-owner"; + # write the sizes file + open my $sizes, '>', $_ = catfile $pkg_tars, 'sizes.txt' + or die "$ME: Can't open `$_': $!\n"; + + print $sizes join "\n", + (map { "SIZE($_) = $size{$_}" } sort keys %size), + (map { "SHA256($_) = $sha256{$_}" } sort keys %sha256); + + close($sizes) or die "$ME: Can't close $_: $!\n"; } - # See also environment variables set in main, tuning compression levels - my @COMPRESSIONS = ( - # compressors-dict-key, file-extension, flags-as-string - [ "gzip", "gz", "--gzip" ], - [ "bzip2", "bz2", "--bzip2" ], - [ "lzip", "lz", "--lzip" ], - [ "xz", "xz", "--xz" ], - ); + sub do_cleanup { + my $context = shift; - foreach my $dir ( glob( File::Spec->catdir( $pkgdirs, ( 'exim*-' . $context->{release} ) ) ) ) { - my $dirname = ( File::Spec->splitdir($dir) )[-1]; - foreach my $comp (@COMPRESSIONS) { - my ($compkey, $extension, $flags) = @{$comp}; - next unless $context->{compressors}{$compkey}; - print "Creating: ${pkgs}/${dirname}.tar.${extension}\n" if ($verbose || $debug); - system("$tar cf ${pkgs}/${dirname}.tar.${extension} ${flags} ${ownership} -C ${pkgdirs} ${dirname}"); - } + print "Cleaning up\n" if $verbose; + remove_tree $context->{d}{tmp}, { verbose => $debug + $verbose }; } } -# ------------------------------------------------------------------ MAIN: { - $0 =~ m|^(?:\./)?release-process/scripts/| - or die "$0: please call this script from the root of the Exim project sources\n"; - - my $context = { + # some of these settings are useful only if we're in the + # exim-projekt-root, but the check, if we're, is deferred + my $context = Context->new( pkgname => 'exim', - orig_dir => File::Spec->curdir(), - tmp_dir => File::Temp->newdir(), - webgen_base => "$FindBin::Bin/../../../exim-website", + website_base => abs_path('../exim-website'), tar_cmd => 'tar', tar_perms => { user => '0', @@ -424,49 +507,73 @@ MAIN: { xz => 1, lzip => 0, }, - build_docs => 1, + docs => 1, web => 1, - }; - my $delete; - my $cleanup = 1; + delete => 0, + cleanup => 1, + gpg => { + sign => 1, + key => undef, + }, + ); + ##$ENV{'PATH'} = '/opt/local/bin:' . $ENV{'PATH'}; # We are creating files for mass distribution, so work harder to make smaller files. - $ENV{'GZIP'} = '-9'; - $ENV{'BZIP2'} = '-9'; + $ENV{GZIP} = -9; + $ENV{BZIP2} = -9; # xz documents minimum file sizes for levels higher than -6 to be useful and each # requires more RAM on the decompressing system. Exim tarball currently 24MiB so # using -8. - $ENV{'XZ_DEFAULTS'} = '-8'; + $ENV{XZ_DEFAULTS} = -8; GetOptions( - 'directory=s' => \$context->{directory}, - 'webgen_base=s' => \$context->{webgen_base}, - 'tar=s' => \$context->{tar_cmd}, - 'make=s' => \$context->{make_cmd}, + $context, + qw(workspace|tmp=s outdir=s website_base|webgen_base=s tar_cmd=s make_cmd=s docs|build-docs! web|build-web! + delete! cleanup!), + 'sign!' => \$context->{gpg}{sign}, + 'key=s' => \$context->{gpg}{key}, 'lzip!' => \$context->{compressors}{lzip}, 'verbose!' => \$verbose, 'debug!' => \$debug, 'help|?' => sub { pod2usage(-verbose => 1, -exit => 0) }, 'man!' => sub { pod2usage(-verbose => 2, -exit => 0, -noperldoc => system('perldoc -V >/dev/null 2>&1')) }, - 'delete!' => \$delete, - 'cleanup!' => \$cleanup, - 'build-docs!' => \$context->{build_docs}, - 'web!' => \$context->{web}, - ) and @ARGV == 1 or pod2usage; - - umask(022); - get_and_check_version( shift, $context ); - fix_paths_tar($context); - $context->{tag} = build_tag($context); - deal_with_working_directory( $context, $delete ); - export_git_tree($context); - chdir( $context->{directory} ) || die; - unpack_tree($context); - make_version_script($context); - build_documentation($context) if $context->{build_docs}; - build_package_directories($context); - create_tar_files($context); - do_cleanup($context) if ($cleanup); + ) and @ARGV == 2 or pod2usage; + + -f '.exim-project-root' + or die "$ME: please call this script from the root of the Exim project sources\n"; + + $context->{OUTDIR} = pop @ARGV; + + if ($context->{gpg}{sign}) { + $context->{gpg}{key} //= do { chomp($_ = qx/git config user.signingkey/); $_ } + || $ENV{EXIM_KEY} + || do { + warn "$ME: No GPG key, using default\n"; + undef; + } + } + + + warn "$ME: changed umask to 022\n" if umask(022) != 022; + + $context->check_version(shift); + $context->override_tar_cmd; + $context->prepare_working_directory; + $context->export_git_tree; + $context->unpack_tree; + $context->make_version_script; + $context->build_documentation if $context->{docs}; + $context->build_html_documentation if $context->{docs} && $context->{web}; + + $context->build_src_package_directory; + $context->build_doc_packages_directory if $context->{docs}; + + $context->create_tar_files; + $context->sign if $context->{gpg}{sign}; + $context->move_to_outdir; + $context->do_cleanup if $context->{cleanup}; + + ### $context } 1; @@ -479,7 +586,7 @@ mk_exim_release - Build an exim release =head1 SYNOPSIS - mk_exim_release [options] version + mk_exim_release [options] version PKG-DIRECTORY =head1 DESCRIPTION @@ -487,7 +594,9 @@ B<mk_exim_release> builds an exim release. Starting in a populated git repo that has already been tagged for release it builds docs, packages etc. Parameter is the version number -to build as - ie 4.72 4.72RC1, 4.86.1, etc +to build as - ie 4.72 4.72-RC1, 4.86.1, etc, without any prefix. + +This scripts expects to find a tag "exim-<version>". After creating the release files, they should be signed. There is another helper for creating the signatures: @@ -495,24 +604,28 @@ F<release-process/scripts/sign_exim_packages>. Call B<mk_exim_release> about like this: - release-process/scripts/mk_exim_release 4.99 + release-process/scripts/mk_exim_release 4.99 OUT-DIR =head1 OPTIONS =over 4 +=item B<--[no]cleanup> + +Do (or do not) cleanup the tmp directory at exit (default: do cleanup) + =item B<--[no]debug> Forces debug mode. (default: no debug info) =item B<--[no]delete> -Delete a pre-existing package directory at start. (default: don't delete) +Delete a pre-existing tmp- and package-directory at start. (default: don't delete) -=item B<--directory> I<dir> +=item B<--tmpdir> I<dir> -Change the name of the package directory (default: F<< exim-packaging-<version> >>) +Change the name of the tmp directory (default: temporary directory) =item B<--[no]help> @@ -536,10 +649,33 @@ Display man page and exit cleanly. (default: don't do that) Use to override the path to the C<tar> command. Need GNU tar in case I<lzip> is selected. (default: C<gtar>, if not found, use C<tar>) +=item B<--[no]sign> + +Sign the created archive files (and the sizes.txt). (default: sign) + +=item B<--key> I<GPG key> + +Use this GPG key for signing. If nothing is specified the first one of this list +is used: + +=over 8 + +=item - git config user.signingkey + +=item - environment C<EXIM_KEY> + +=item - default GPG key + +=back + =item B<--[no]web> Control the creation of the website. For creation of the website, the F<../exim-website> -directory must exist. (default: create the website) +(but see the B<website-base> option) directory must exist. (default: create the website) + +=item B<--website-base> I<dir> + +Base directory for the web site generation (default: F<../exim-website>) =item B<--verbose> diff --git a/release-process/scripts/sign_exim_packages b/release-process/scripts/sign_exim_packages index a504ea826..e76840996 100755 --- a/release-process/scripts/sign_exim_packages +++ b/release-process/scripts/sign_exim_packages @@ -40,24 +40,24 @@ case "${EXIM_KEY:-default}" in default|DEFAULT) gpg_sign() { ${GPG_COMMAND} --detach-sig --armor "${1:?}" ; } ;; -*) +*) gpg_sign() { ${GPG_COMMAND} --local-user "${EXIM_KEY}" --detach-sig --armor "${1:?}" ; } ;; esac cd_to() { echo "Working in: $1"; cd "$1"; } -okay=false -if [ -d ../../release-process ] && [ "${PWD##*/}" = "pkgs" ]; then - okay=true # we are in right dir -elif [ -d release-process ]; then - b="$(find . -maxdepth 1 -name 'exim-packaging-*' | sort | tail -n 1)" - if [ ".$b" != "." ]; then - cd_to "$b/pkgs" - okay=true - fi -fi -if ! $okay; then +#okay=false +#if [ -d ../../release-process ] && [ "${PWD##*/}" = "pkgs" ]; then +# okay=true # we are in right dir +#elif [ -d release-process ]; then +# b="$(find . -maxdepth 1 -name 'exim-packaging-*' | sort | tail -n 1)" +# if [ ".$b" != "." ]; then +# cd_to "$b/pkgs" +# okay=true +# fi +#fi +#if ! $okay; then if [ -d "${1:?need a directory to look in}" ]; then cd_to "$1" shift @@ -65,11 +65,10 @@ if ! $okay; then printf "%s: %s\n" >&2 "$(basename "$0")" "where should I be looking" exit 1 fi -fi +#fi # Assumes no whitespace (strictly, $IFS) in filenames, which we're okay with set $(find . -name '*.asc' -prune -o -type f -print | cut -c 3- | sort) - for FILE do echo "Signing: $FILE" diff --git a/release-process/scripts/stats_for_email b/release-process/scripts/stats_for_email index 0eb0c2981..45d06b6c1 100755 --- a/release-process/scripts/stats_for_email +++ b/release-process/scripts/stats_for_email @@ -1,16 +1,16 @@ #!/bin/sh -eu okay=false -if [ -d ../../release-process ] && [ "${PWD##*/}" = "pkgs" ]; then - okay=true # we are in right dir -elif [ -d release-process ]; then - b="$(find . -maxdepth 1 -name 'exim-packaging-*' | sort | tail -n 1)" - if [ ".$b" != "." ]; then - cd "$b/pkgs" - okay=true - fi -fi -if ! $okay; then +# if [ -d ../../release-process ] && [ "${PWD##*/}" = "pkgs" ]; then +# okay=true # we are in right dir +# elif [ -d release-process ]; then +# b="$(find . -maxdepth 1 -name 'exim-packaging-*' | sort | tail -n 1)" +# if [ ".$b" != "." ]; then +# cd "$b/pkgs" +# okay=true +# fi +# fi +# if ! $okay; then if [ -d "${1:?need a directory to look in}" ]; then cd "$1" shift @@ -18,7 +18,7 @@ if ! $okay; then printf "%s: %s\n" >&2 "$(basename "$0")" "where should I be looking" exit 1 fi -fi +# fi set $(find "${1:-.}" -name '*.asc' -prune -o -type f -print | cut -c 3- | sort) diff --git a/src/ACKNOWLEDGMENTS b/src/ACKNOWLEDGMENTS index 2e1ede016..22e9909c0 100644 --- a/src/ACKNOWLEDGMENTS +++ b/src/ACKNOWLEDGMENTS @@ -67,8 +67,8 @@ Paul Kelly MySQL interface Ian Kirk Radius support Stuart Levy Replacement for broken inet_ntoa() on IRIX Stuart Lynne First code for LDAP -Nigel Metheringham Setting up the web site and mailing list - Managing the web site and mailing list +Nigel Metheringham Setting up the website and mailing list + Managing the website and mailing list Interface to Berkeley DB Support for cdb Support for maildir diff --git a/src/README b/src/README index 652cee6ef..225295efb 100644 --- a/src/README +++ b/src/README @@ -1,7 +1,7 @@ THE EXIM MAIL TRANSFER AGENT VERSION 4 -------------------------------------- -Copyright (c) 1995 - 2012 University of Cambridge. +Copyright (c) 1995 - 2018 University of Cambridge. See the file NOTICE for conditions of use and distribution. There is a book about Exim by Philip Hazel called "The Exim SMTP Mail Server", @@ -14,7 +14,7 @@ from Exim 3, though the basic structure and philosophy remains the same. The older book may be helpful for the background, but a lot of the detail has changed, so it is likely to be confusing to newcomers. -There is a web site at http://www.exim.org; this contains details of the +There is a website at https://www.exim.org; this contains details of the mailing list exim-users@exim.org. A copy of the Exim FAQ should be available from the same source that you used diff --git a/src/README.UPDATING b/src/README.UPDATING index 2438cc953..b619f5e03 100644 --- a/src/README.UPDATING +++ b/src/README.UPDATING @@ -92,7 +92,7 @@ Exim version 4.83 ----------------- * SPF condition results renamed "permerror" and "temperror". The old - names are still accepted for back-compatability, for this release. + names are still accepted for back-compatibility, for this release. * TLS details are now logged on rejects, subject to log selectors. @@ -133,7 +133,7 @@ Exim version 4.80 upgrading, then lock the message, replace the new-lines that should be part of the -tls_peerdn line with the two-character sequence \n and then unlock the message. No tool has been provided as we believe this is a rare - occurence. + occurrence. * For OpenSSL, SSLv2 is now disabled by default. (GnuTLS does not support SSLv2). RFC 6176 prohibits SSLv2 and some informal surveys suggest no @@ -346,7 +346,7 @@ Exim version 4.70 ----------------- 1. Experimental Yahoo! Domainkeys support has been dropped in this release. -It has been superceded by a native implementation of its successor DKIM. +It has been superseded by a native implementation of its successor DKIM. 2. Up to version 4.69, Exim came with an embedded version of the PCRE library. As of 4.70, this is no longer the case. To compile Exim, you will need PCRE diff --git a/src/scripts/Configure-os.h b/src/scripts/Configure-os.h index e9f6afd98..ae1ecf943 100755 --- a/src/scripts/Configure-os.h +++ b/src/scripts/Configure-os.h @@ -28,7 +28,7 @@ then echo "" fi rm -f os.h -# In order to accomodate for the fudge below, copy the file instead of +# In order to accommodate for the fudge below, copy the file instead of # symlinking it. Otherwise we pollute the clean copy with the fudge. cp -p ../OS/os.h-$os os.h || exit 1 diff --git a/src/scripts/reversion b/src/scripts/reversion index 0ee2f8dc7..3657cfcba 100755 --- a/src/scripts/reversion +++ b/src/scripts/reversion @@ -29,43 +29,41 @@ fi # Read version information that was generated by a previous run of # this script, or during the release process. -if [ -f ./version.sh ] -then . ./version.sh -elif [ -f ../src/version.sh ] -then . ../src/version.sh -fi - -# If this tree is a git working directory, use that to get version information. - -if [ -d ../../.git ] || [ -f ../../.git ] || [ "$1" = "release" ] -then - # Modify the output of git describe into separate parts for - # the name "exim" and the release and variant versions. - # Put a dot in the version number and remove a spurious g. - if [ "$2" ] - then - description=$(git describe "$2") - else - description=$(git describe --dirty=-XX --match 'exim-4*') - fi - set $(echo "$description" | sed 's|-| |;s|_|.|;s|[-_]| _|;s|-g|-|') - # Only update if we need to - if [ "$2 $3" != "$EXIM_RELEASE_VERSION $EXIM_VARIANT_VERSION" ] - then - EXIM_RELEASE_VERSION="$2" - EXIM_VARIANT_VERSION="$3" - rm -f version.h - fi +if [ -f ./version.sh ]; then + . ./version.sh +elif [ -f ../src/version.sh ]; then + . ../src/version.sh +elif [ -d ../../.git ] || [ -f ../../.git ] || [ "$1" = release ]; then + # Modify the output of git describe into separate parts for + # the name "exim" and the release and variant versions. + # Put a dot in the version number and remove a spurious g. + if [ "$2" ] + then + description=$(git describe "$2") + else + description=$(git describe --dirty=-XX --match 'exim-4*') + fi + set $(echo "$description" | sed 's/-/ /; s/-g/-/') + # Only update if we need to + if [ "$2 $3" != "$EXIM_RELEASE_VERSION $EXIM_VARIANT_VERSION" ] + then + EXIM_RELEASE_VERSION="$2" + EXIM_VARIANT_VERSION="$3" + rm -f version.h + fi +else + echo "Cannot determine the release number" >&2 + exit fi # If you are maintaining a patched version of Exim, you can either # create your own version.sh as part of your release process, or you # can modify EXIM_VARIANT_VERSION at this point in this script. -case "$EXIM_RELEASE_VERSION" in -'') echo "*** Your copy of Exim lacks any version information." - exit 1 -esac +if test -z "$EXIM_RELEASE_VERSION"; then + echo "$0: Your copy of Exim lacks any version information." >&2 + exit 1 +fi EXIM_COMPILE_NUMBER=$(expr "${EXIM_COMPILE_NUMBER:-0}" + 1) @@ -101,6 +99,7 @@ fi ( echo '# automatically generated file - see ../scripts/reversion' echo EXIM_RELEASE_VERSION='"'"$EXIM_RELEASE_VERSION"'"' + test -n "$EXIM_VARIANT_VERSION" && \ echo EXIM_VARIANT_VERSION='"'"$EXIM_VARIANT_VERSION"'"' echo EXIM_COMPILE_NUMBER='"'"$EXIM_COMPILE_NUMBER"'"' if [ ".${exim_build_date_override:-}" != "." ]; then @@ -112,13 +111,18 @@ if [ ! -f version.h ] then ( echo '/* automatically generated file - see ../scripts/reversion */' echo '#define EXIM_RELEASE_VERSION "'"$EXIM_RELEASE_VERSION"'"' + test -n "$EXIM_VARIANT_VERSION" && \ echo '#define EXIM_VARIANT_VERSION "'"$EXIM_VARIANT_VERSION"'"' - echo '#define EXIM_VERSION_STR EXIM_RELEASE_VERSION EXIM_VARIANT_VERSION' + echo '#ifdef EXIM_VARIANT_VERSION' + echo '#define EXIM_VERSION_STR EXIM_RELEASE_VERSION "-" EXIM_VARIANT_VERSION' + echo '#else' + echo '#define EXIM_VERSION_STR EXIM_RELEASE_VERSION' + echo '#endif' if [ ".${exim_build_date_override:-}" != "." ]; then echo '#define EXIM_BUILD_DATE_OVERRIDE "'"${exim_build_date_override}"'"' fi ) >version.h fi -echo ">>> version $EXIM_RELEASE_VERSION$EXIM_VARIANT_VERSION #$EXIM_COMPILE_NUMBER" +echo ">>> version $EXIM_RELEASE_VERSION $EXIM_VARIANT_VERSION #$EXIM_COMPILE_NUMBER" echo diff --git a/src/src/aliases.default b/src/src/aliases.default index ca48b3a80..725d172a9 100644 --- a/src/src/aliases.default +++ b/src/src/aliases.default @@ -35,6 +35,6 @@ # # abuse: the person dealing with network and mail abuse # hostmaster: the person dealing with DNS problems -# webmaster: the person dealing with your web site +# webmaster: the person dealing with your website #### diff --git a/src/src/configure.default b/src/src/configure.default index 838926f97..555dec3ec 100644 --- a/src/src/configure.default +++ b/src/src/configure.default @@ -9,7 +9,7 @@ # configuration file. There are many more than are mentioned here. The # manual is in the file doc/spec.txt in the Exim distribution as a plain # ASCII file. Other formats (PostScript, Texinfo, HTML, PDF) are available -# from the Exim ftp sites. The manual is also online at the Exim web sites. +# from the Exim ftp sites. The manual is also online at the Exim website. # This file is divided into several parts, all but the first of which are @@ -38,6 +38,18 @@ ###################################################################### +# MACROS # +###################################################################### +# + +# If you want to use a smarthost instead of sending directly to recipient +# domains, uncomment this macro definition and set a real hostname. +# An appropriately privileged user can then redirect email on the command-line +# in emergencies, via -D. +# +# ROUTER_SMARTHOST=MAIL.HOSTNAME.FOR.CENTRAL.SERVER.EXAMPLE + +###################################################################### # MAIN CONFIGURATION SETTINGS # ###################################################################### # @@ -107,9 +119,11 @@ hostlist relay_from_hosts = localhost # manual for details. The lists above are used in the access control lists for # checking incoming messages. The names of these ACLs are defined here: -acl_smtp_rcpt = acl_check_rcpt -acl_smtp_data_prdr = acl_check_prdr -acl_smtp_data = acl_check_data +acl_smtp_rcpt = acl_check_rcpt +.ifdef _HAVE_PRDR +acl_smtp_data_prdr = acl_check_prdr +.endif +acl_smtp_data = acl_check_data # You should not change those settings until you understand how ACLs work. @@ -252,7 +266,9 @@ dns_dnssec_ok = 1 # may request to use it. For multi-recipient mails we then can # reject or accept per-user after the message is received. # +.ifdef _HAVE_PRDR prdr_enable = true +.endif # By default, Exim expects all envelope addresses to be fully qualified, that @@ -272,7 +288,7 @@ prdr_enable = true # detail than the default. Adjust to suit. log_selector = +smtp_protocol_error +smtp_syntax_error \ - +tls_certificate_verified + +tls_certificate_verified # If you want Exim to support the "percent hack" for certain domains, @@ -462,8 +478,8 @@ acl_check_rcpt: # Insist that a HELO/EHLO was accepted. - require message = nice hosts say HELO first - condition = ${if def:sender_helo_name} + require message = nice hosts say HELO first + condition = ${if def:sender_helo_name} # Insist that any other recipient address that we accept is either in one of # our local domains, or is in a domain for which we explicitly allow @@ -530,8 +546,10 @@ acl_check_rcpt: # We set a variable to record that PRDR was active used, so that checking # in the data ACL can be skipped. +.ifdef _HAVE_PRDR acl_check_prdr: - warn set acl_m_did_prdr = y + warn set acl_m_did_prdr = y +.endif ############################################################################# # do lookup on filtering, with $local_part@$domain, deny on filter match @@ -561,9 +579,9 @@ acl_check_data: # Deny if the headers contain badly-formed addresses. # - deny !verify = header_syntax - message = header syntax - log_message = header syntax ($acl_verify_message) + deny !verify = header_syntax + message = header syntax + log_message = header syntax ($acl_verify_message) # Deny if the message contains a virus. Before enabling this check, you # must install a virus scanner and set the av_scanner option above. @@ -625,6 +643,25 @@ begin routers # transport = remote_smtp +# This router can be used when you want to send all mail to a +# server which handles DNS lookups for you; an ISP will typically run such +# a server for their customers. The hostname in route_data comes from the +# macro defined at the top of the file. If not defined, then we'll use the +# dnslookup router below instead. +# Beware that the hostname is specified again in the Transport. + +.ifdef ROUTER_SMARTHOST + +smarthost: + driver = manualroute + domains = ! +local_domains + transport = smarthost_smtp + route_data = ROUTER_SMARTHOST + ignore_target_hosts = <; 0.0.0.0 ; 127.0.0.0/8 ; ::1 + no_more + +.else + # This router routes addresses that are not in local domains by doing a DNS # lookup on the domain name. The exclamation mark that appears in "domains = ! # +local_domains" is a negating operator, that is, it can be read as "not". The @@ -648,20 +685,9 @@ dnslookup: dnssec_request_domains = * no_more - -# This alternative router can be used when you want to send all mail to a -# server which handles DNS lookups for you; an ISP will typically run such -# a server for their customers. If you uncomment "smarthost" then you -# should comment out "dnslookup" above. Setting a real hostname in route_data -# wouldn't hurt either. - -# smarthost: -# driver = manualroute -# domains = ! +local_domains -# transport = smarthost_smtp -# route_data = MAIL.HOSTNAME.FOR.CENTRAL.SERVER.EXAMPLE -# ignore_target_hosts = <; 0.0.0.0 ; 127.0.0.0/8 ; ::1 -# no_more +# This closes the ROUTER_SMARTHOST ifdef around the choice of routing for +# off-site mail. +.endif # The remaining routers handle addresses in the local domain(s), that is those @@ -777,12 +803,14 @@ begin transports remote_smtp: driver = smtp - hosts_try_prdr = * message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}} .ifdef _HAVE_DANE dnssec_request_domains = * hosts_try_dane = * .endif +.ifdef _HAVE_PRDR + hosts_try_prdr = * +.endif # This transport is used for delivering messages to a smarthost, if the @@ -794,7 +822,6 @@ remote_smtp: smarthost_smtp: driver = smtp - hosts_try_prdr = * message_size_limit = ${if > {$max_received_linelength}{998} {1}{0}} multi_domain # @@ -802,13 +829,19 @@ smarthost_smtp: # Comment out any of these which you have to, then file a Support # request with your smarthost provider to get things fixed: hosts_require_tls = * - tls_sni = $host tls_verify_hosts = * # As long as tls_verify_hosts is enabled, this won't matter, but if you # have to comment it out then this will at least log whether you succeed # or not: tls_try_verify_hosts = * # + # The SNI name should match the name which we'll expect to verify; + # many mail systems don't use SNI and this doesn't matter, but if it does, + # we need to send a name which the remote site will recognize. + # This _should_ be the name which the smarthost operators specified as + # the hostname for sending your mail to. + tls_sni = ROUTER_SMARTHOST + # .ifdef _HAVE_OPENSSL tls_require_ciphers = HIGH:!aNULL:@STRENGTH .endif @@ -816,6 +849,9 @@ smarthost_smtp: tls_require_ciphers = SECURE192:-VERS-SSL3.0:-VERS-TLS1.0:-VERS-TLS1.1 .endif .endif +.ifdef _HAVE_PRDR + hosts_try_prdr = * +.endif # This transport is used for local delivery to user mailboxes in traditional diff --git a/src/src/dane-openssl.c b/src/src/dane-openssl.c index c967a73d1..a6792d1ae 100644 --- a/src/src/dane-openssl.c +++ b/src/src/dane-openssl.c @@ -411,7 +411,7 @@ set_issuer_name(X509 *cert, AUTHORITY_KEYID *akid, X509_NAME *subj) X509_NAME *name = akid_issuer_name(akid); /* - * If subject's akid specifies an authority key identifer issuer name, we + * If subject's akid specifies an authority key identifier issuer name, we * must use that. */ return X509_set_issuer_name(cert, diff --git a/src/src/exim.c b/src/src/exim.c index 32bd3968f..8e700f711 100644 --- a/src/src/exim.c +++ b/src/src/exim.c @@ -2686,7 +2686,7 @@ for (i = 1; i < argc; i++) #ifdef SUPPORT_TLS /* -MCt: similar to -MCT below but the connection is still open - via a proxy proces which handles the TLS context and coding. + via a proxy process which handles the TLS context and coding. Require three arguments for the proxied local address and port, and the TLS cipher. */ @@ -3638,7 +3638,7 @@ if (f.running_in_test_harness) smtputf8_advertise_hosts = NULL; is a failure. It leaves the configuration file open so that the subsequent configuration data for delivery can be read if needed. -NOTE: immediatly after opening the configuration file we change the working +NOTE: immediately after opening the configuration file we change the working directory to "/"! Later we change to $spool_directory. We do it there, because during readconf_main() some expansion takes place already. */ diff --git a/src/src/eximstats.src b/src/src/eximstats.src index 8eb5cac89..5e1a0847b 100644 --- a/src/src/eximstats.src +++ b/src/src/eximstats.src @@ -533,7 +533,7 @@ about how to create charts from the tables. =head1 AUTHOR -There is a web site at http://www.exim.org - this contains details of the +There is a website at https://www.exim.org - this contains details of the mailing list exim-users@exim.org. =head1 TO DO diff --git a/src/src/expand.c b/src/src/expand.c index aa4d0289e..e3615cdb0 100644 --- a/src/src/expand.c +++ b/src/src/expand.c @@ -4837,7 +4837,7 @@ while (*s != 0) (void)sscanf(CS now,"%u",&inow); (void)sscanf(CS daystamp,"%u",&iexpire); - /* When "iexpire" is < 7, a "flip" has occured. + /* When "iexpire" is < 7, a "flip" has occurred. Adjust "inow" accordingly. */ if ( (iexpire < 7) && (inow >= 993) ) inow = 0; @@ -5664,6 +5664,12 @@ while (*s != 0) uschar *sub[3]; int save_expand_nmax = save_expand_strings(save_expand_nstring, save_expand_nlength); + + /* On reflection the original behaviour of extract-json for a string + result, leaving it quoted, was a mistake. But it was already published, + hence the addition of jsons. In a future major version, make json + work like josons, and withdraw jsons. */ + enum {extract_basic, extract_json, extract_jsons} fmt = extract_basic; while (isspace(*s)) s++; @@ -7516,7 +7522,7 @@ while (*s != 0) continue; } - /* Handle time period formating */ + /* Handle time period formatting */ case EOP_TIME_EVAL: { diff --git a/src/src/globals.h b/src/src/globals.h index 453d8325d..12cc1af56 100644 --- a/src/src/globals.h +++ b/src/src/globals.h @@ -492,7 +492,7 @@ extern BOOL disable_fsync; /* Not for normal use */ extern BOOL disable_ipv6; /* Don't do any IPv6 things */ #ifndef DISABLE_DKIM -extern unsigned dkim_collect_input; /* Runtime count of dkim signtures; tracks wether SMTP input is fed to DKIM validation */ +extern unsigned dkim_collect_input; /* Runtime count of dkim signtures; tracks whether SMTP input is fed to DKIM validation */ extern uschar *dkim_cur_signer; /* Expansion variable, holds the current "signer" domain or identity during a acl_smtp_dkim run */ extern int dkim_key_length; /* Expansion variable, length of signing key in bits */ extern void *dkim_signatures; /* Actually a (pdkim_signature *) but most files do not need to know */ diff --git a/src/src/lookups/oracle.c b/src/src/lookups/oracle.c index 13f12eacb..d57314580 100644 --- a/src/src/lookups/oracle.c +++ b/src/src/lookups/oracle.c @@ -414,7 +414,7 @@ while (cda->rc != NO_DATA_FOUND) /* Loop for each row */ result = string_catn(result, s, slen); result = string_catn(result, US"=", 1); - /* int and float type wont ever need escaping. Otherwise, quote the value + /* int and float type won't ever need escaping. Otherwise, quote the value if it contains spaces or is empty. */ if (desc[i].dbtype != INT_TYPE && desc[i].dbtype != FLOAT_TYPE && diff --git a/src/src/malware.c b/src/src/malware.c index bb8f2bcc0..2e783e398 100644 --- a/src/src/malware.c +++ b/src/src/malware.c @@ -49,6 +49,7 @@ typedef enum { #ifndef DISABLE_MAL_CMDLINE M_CMDL, #endif + M_DUMMY } scanner_t; typedef enum {MC_NONE, MC_TCP, MC_UNIX, MC_STRM} contype_t; static struct scan @@ -1975,7 +1976,7 @@ b_seek: err = errno; and the [ ] marker. [+] - not infected [L] - infected - [E] - some error occured + [E] - some error occurred Such marker follows the first non-escaped TAB. For more information see avast-protocol(5) diff --git a/src/src/pdkim/signing.c b/src/src/pdkim/signing.c index d7491565f..a47f824b8 100644 --- a/src/src/pdkim/signing.c +++ b/src/src/pdkim/signing.c @@ -831,7 +831,6 @@ const uschar * exim_dkim_verify(ev_ctx * verify_ctx, hashmethod hash, blob * data, blob * sig) { const EVP_MD * md; -const uschar * where; switch (hash) { @@ -847,36 +846,39 @@ if (!md) { EVP_MD_CTX * ctx; - if ( (ctx = EVP_MD_CTX_new()) - && EVP_DigestVerifyInit(ctx, NULL, md, NULL, verify_ctx->key) > 0 - && EVP_DigestVerify(ctx, sig->data, sig->len, data->data, data->len) > 0 - ) - { EVP_MD_CTX_free(ctx); return NULL; } - - if (ctx) EVP_MD_CTX_free(ctx); + if ((ctx = EVP_MD_CTX_new())) + { + if ( EVP_DigestVerifyInit(ctx, NULL, md, NULL, verify_ctx->key) > 0 + && EVP_DigestVerify(ctx, sig->data, sig->len, data->data, data->len) > 0 + ) + { EVP_MD_CTX_free(ctx); return NULL; } + EVP_MD_CTX_free(ctx); + } } else #endif { EVP_PKEY_CTX * ctx; - if ( (where = US"EVP_PKEY_CTX_new", - (ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL))) - && (where = US"EVP_PKEY_verify_init", - EVP_PKEY_verify_init(ctx) > 0) - && (where = US"EVP_PKEY_CTX_set_rsa_padding", - EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0) - && (where = US"EVP_PKEY_CTX_set_signature_md", - EVP_PKEY_CTX_set_signature_md(ctx, md) > 0) - && (where = US"EVP_PKEY_verify", - EVP_PKEY_verify(ctx, sig->data, sig->len, - data->data, data->len) == 1) - ) - { EVP_PKEY_CTX_free(ctx); return NULL; } - - if (ctx) EVP_PKEY_CTX_free(ctx); + if ((ctx = EVP_PKEY_CTX_new(verify_ctx->key, NULL))) + { + if ( EVP_PKEY_verify_init(ctx) > 0 + && EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) > 0 + && EVP_PKEY_CTX_set_signature_md(ctx, md) > 0 + && EVP_PKEY_verify(ctx, sig->data, sig->len, + data->data, data->len) == 1 + ) + { EVP_PKEY_CTX_free(ctx); return NULL; } + EVP_PKEY_CTX_free(ctx); + + DEBUG(D_tls) + if (Ustrcmp(ERR_reason_error_string(ERR_peek_error()), "wrong signature length") == 0) + debug_printf("sig len (from msg hdr): %d, expected (from dns pubkey) %d\n", + (int) sig->len, EVP_PKEY_size(verify_ctx->key)); + } } -return string_sprintf("%s: %s", where, ERR_error_string(ERR_get_error(), NULL)); + +return US ERR_error_string(ERR_get_error(), NULL); } diff --git a/src/src/rda.c b/src/src/rda.c index 078f4fe4b..228f57409 100644 --- a/src/src/rda.c +++ b/src/src/rda.c @@ -486,7 +486,7 @@ return TRUE; /* This function is passed a forward list string (unexpanded) or the name of a file (unexpanded) whose contents are the forwarding list. The list may in fact be a filter program if it starts with "#Exim filter" or "#Sieve filter". Other -types of filter, with different inital tag strings, may be introduced in due +types of filter, with different initial tag strings, may be introduced in due course. The job of the function is to process the forwarding list or filter. It is diff --git a/src/src/readconf.c b/src/src/readconf.c index d7e9d30fa..eb6844222 100644 --- a/src/src/readconf.c +++ b/src/src/readconf.c @@ -959,7 +959,7 @@ for (;;) /* Handle conditionals, which are also applied to physical lines. Conditions are of the form ".ifdef ANYTEXT" and are treated as true if any macro - expansion occured on the rest of the line. A preliminary test for the leading + expansion occurred on the rest of the line. A preliminary test for the leading '.' saves effort on most lines. */ if (*ss == '.') @@ -2123,7 +2123,7 @@ switch (type) inttype = US"octal "; /* Integer: a simple(ish) case; allow octal and hex formats, and - suffixes K, M and G. The different types affect output, not input. */ + suffixes K, M, G, and T. The different types affect output, not input. */ case opt_mkint: case opt_int: @@ -2140,7 +2140,7 @@ switch (type) if (errno != ERANGE && *endptr) { - uschar * mp = US"GgMmKk\0"; /* YyZzEePpTtGgMmKk */ + uschar * mp = US"TtGgMmKk\0"; /* YyZzEePpTtGgMmKk */ if ((mp = Ustrchr(mp, *endptr))) { @@ -2175,8 +2175,7 @@ switch (type) *(int *)ol->value = value; break; - /* Integer held in K: again, allow octal and hex formats, and suffixes K, M, - G and T. */ + /* Integer held in K: again, allow formats and suffixes as above. */ case opt_Kint: { @@ -2190,12 +2189,12 @@ switch (type) if (errno != ERANGE && *endptr) { - uschar * mp = US"EePpTtGgMmKk\0"; /* YyZzEePpTtGgMmKk */ + uschar * mp = US"ZzEePpTtGgMmKk\0"; /* YyZzEePpTtGgMmKk */ if ((mp = Ustrchr(mp, *endptr))) { endptr++; - do + while (*(mp += 2)) { if (lvalue > EXIM_ARITH_MAX/1024 || lvalue < EXIM_ARITH_MIN/1024) { @@ -2204,7 +2203,6 @@ switch (type) } lvalue *= 1024; } - while (*(mp += 2)); } else lvalue = (lvalue + 512)/1024; @@ -2482,6 +2480,7 @@ switch(ol->type & opt_mask) int_eximarith_t x = *((int_eximarith_t *)value); if (!no_labels) printf("%s = ", name); if (x == 0) printf("0\n"); + else if ((x & ((1<<30)-1)) == 0) printf(PR_EXIM_ARITH "T\n", x >> 30); else if ((x & ((1<<20)-1)) == 0) printf(PR_EXIM_ARITH "G\n", x >> 20); else if ((x & ((1<<10)-1)) == 0) printf(PR_EXIM_ARITH "M\n", x >> 10); else printf(PR_EXIM_ARITH "K\n", x); diff --git a/src/src/receive.c b/src/src/receive.c index ba4767916..c851d4bd9 100644 --- a/src/src/receive.c +++ b/src/src/receive.c @@ -1822,8 +1822,11 @@ for (;;) if (ptr >= header_size - 4) { int oldsize = header_size; - /* header_size += 256; */ + + if (header_size >= INT_MAX/2) + goto OVERSIZE; header_size *= 2; + if (!store_extend(next->text, oldsize, header_size)) next->text = store_newblock(next->text, header_size, ptr); } @@ -1929,6 +1932,7 @@ for (;;) if (message_size >= header_maxsize) { +OVERSIZE: next->text[ptr] = 0; next->slen = ptr; next->type = htype_other; @@ -2000,7 +2004,8 @@ for (;;) if (nextch == ' ' || nextch == '\t') { next->text[ptr++] = nextch; - message_size++; + if (++message_size >= header_maxsize) + goto OVERSIZE; continue; /* Iterate the loop */ } else if (nextch != EOF) (receive_ungetc)(nextch); /* For next time */ diff --git a/src/src/routers/accept.c b/src/src/routers/accept.c index 65b6fb967..eb5b95511 100644 --- a/src/src/routers/accept.c +++ b/src/src/routers/accept.c @@ -117,7 +117,7 @@ DEBUG(D_route) debug_printf("%s router called for %s\n domain = %s\n", rc = rf_get_errors_address(addr, rblock, verify, &errors_to); if (rc != OK) return rc; -/* Set up the additional and removeable headers for the address. */ +/* Set up the additional and removable headers for the address. */ rc = rf_get_munge_headers(addr, rblock, &extra_headers, &remove_headers); if (rc != OK) return rc; diff --git a/src/src/routers/dnslookup.c b/src/src/routers/dnslookup.c index d6d7d0642..33939be4c 100644 --- a/src/src/routers/dnslookup.c +++ b/src/src/routers/dnslookup.c @@ -459,7 +459,7 @@ else if (ob->check_secondary_mx && !testflag(addr, af_local_host_removed)) rc = rf_get_errors_address(addr, rblock, verify, &addr->prop.errors_address); if (rc != OK) return rc; -/* Set up the additional and removeable headers for this address. */ +/* Set up the additional and removable headers for this address. */ rc = rf_get_munge_headers(addr, rblock, &addr->prop.extra_headers, &addr->prop.remove_headers); diff --git a/src/src/routers/ipliteral.c b/src/src/routers/ipliteral.c index 01eabb1dd..ecc604278 100644 --- a/src/src/routers/ipliteral.c +++ b/src/src/routers/ipliteral.c @@ -179,7 +179,7 @@ addr->host_list = h; rc = rf_get_errors_address(addr, rblock, verify, &addr->prop.errors_address); if (rc != OK) return rc; -/* Set up the additional and removeable headers for this address. */ +/* Set up the additional and removable headers for this address. */ rc = rf_get_munge_headers(addr, rblock, &addr->prop.extra_headers, &addr->prop.remove_headers); diff --git a/src/src/routers/iplookup.c b/src/src/routers/iplookup.c index bc58a1f82..ff67af38d 100644 --- a/src/src/routers/iplookup.c +++ b/src/src/routers/iplookup.c @@ -404,7 +404,7 @@ addr->child_count++; new_addr->next = *addr_new; *addr_new = new_addr; -/* Set up the errors address, if any, and the additional and removeable headers +/* Set up the errors address, if any, and the additional and removable headers for this new address. */ rc = rf_get_errors_address(addr, rblock, verify, &new_addr->prop.errors_address); diff --git a/src/src/routers/manualroute.c b/src/src/routers/manualroute.c index c55c5e52b..f7cca3a42 100644 --- a/src/src/routers/manualroute.c +++ b/src/src/routers/manualroute.c @@ -375,7 +375,7 @@ while (*options) rc = rf_get_errors_address(addr, rblock, verify, &addr->prop.errors_address); if (rc != OK) return rc; -/* Set up the additional and removeable headers for this address. */ +/* Set up the additional and removable headers for this address. */ rc = rf_get_munge_headers(addr, rblock, &addr->prop.extra_headers, &addr->prop.remove_headers); diff --git a/src/src/smtp_in.c b/src/src/smtp_in.c index 439d688fd..b071298c7 100644 --- a/src/src/smtp_in.c +++ b/src/src/smtp_in.c @@ -2080,7 +2080,6 @@ f.dkim_disable_verify = FALSE; dkim_collect_input = 0; dkim_verify_overall = dkim_verify_status = dkim_verify_reason = NULL; dkim_key_length = 0; -dkim_verify_signers = US"$dkim_signers"; #endif #ifdef EXPERIMENTAL_DMARC f.dmarc_has_been_checked = f.dmarc_disable_verify = f.dmarc_enable_forensic = FALSE; diff --git a/src/src/spf.c b/src/src/spf.c index a203c07ba..0b00a5c7c 100644 --- a/src/src/spf.c +++ b/src/src/spf.c @@ -103,7 +103,7 @@ if (!(spf_server && spf_request)) rc = SPF_RESULT_PERMERROR; else if (SPF_request_set_env_from(spf_request, CS spf_envelope_sender)) - /* Invalid sender address. This should be a real rare occurence */ + /* Invalid sender address. This should be a real rare occurrence */ rc = SPF_RESULT_PERMERROR; else diff --git a/src/src/tls-gnu.c b/src/src/tls-gnu.c index 76f733379..faad38f76 100644 --- a/src/src/tls-gnu.c +++ b/src/src/tls-gnu.c @@ -1313,7 +1313,7 @@ if (!exim_gnutls_base_init_done) DEBUG(D_tls) { gnutls_global_set_log_function(exim_gnutls_logger_cb); - /* arbitrarily chosen level; bump upto 9 for more */ + /* arbitrarily chosen level; bump up to 9 for more */ gnutls_global_set_log_level(EXIM_GNUTLS_LIBRARY_LOG_LEVEL); } #endif @@ -2717,7 +2717,7 @@ Only used by the server-side TLS. This feeds DKIM and should be used for all message-body reads. -Arguments: lim Maximum amount to read/bufffer +Arguments: lim Maximum amount to read/buffer Returns: the next character or EOF */ diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c index f94df0bea..ba9e7da11 100644 --- a/src/src/tls-openssl.c +++ b/src/src/tls-openssl.c @@ -2325,6 +2325,8 @@ if (rc <= 0) } DEBUG(D_tls) debug_printf("SSL_accept was successful\n"); +ERR_clear_error(); /* Even success can leave errors in the stack. Seen with + anon-authentication ciphersuite negociated. */ /* TLS has been set up. Adjust the input functions to read via TLS, and initialize things. */ diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c index 8d51ce5b6..9ee1304bc 100644 --- a/src/src/transports/smtp.c +++ b/src/src/transports/smtp.c @@ -825,6 +825,10 @@ if ((dbm_file = dbfn_open(US"misc", O_RDWR, &dbblock, TRUE))) uschar * ehlo_resp_key = ehlo_cache_key(sx); dbdata_ehlo_resp er = { .data = sx->ehlo_resp }; + HDEBUG(D_transport) debug_printf("writing clr %04x/%04x cry %04x/%04x\n", + sx->ehlo_resp.cleartext_features, sx->ehlo_resp.cleartext_auths, + sx->ehlo_resp.crypted_features, sx->ehlo_resp.crypted_auths); + dbfn_write(dbm_file, ehlo_resp_key, &er, (int)sizeof(er)); dbfn_close(dbm_file); } @@ -987,8 +991,11 @@ if (pending_EHLO) || (authbits = study_ehlo_auths(sx)) != *ap) { HDEBUG(D_transport) - debug_printf("EHLO extensions changed, 0x%04x/0x%04x -> 0x%04x/0x%04x\n", + debug_printf("EHLO %s extensions changed, 0x%04x/0x%04x -> 0x%04x/0x%04x\n", + tls_out.active.sock < 0 ? "cleartext" : "crypted", sx->peer_offered, *ap, peer_offered, authbits); + *(tls_out.active.sock < 0 + ? &sx->ehlo_resp.cleartext_features : &sx->ehlo_resp.crypted_features) = peer_offered; *ap = authbits; if (peer_offered & OPTION_EARLY_PIPE) write_ehlo_cache_entry(sx); @@ -2980,7 +2987,7 @@ Or just forget about lines? Or inflate by a fixed proportion? */ } #ifndef DISABLE_PRDR -/* If it supports Per-Recipient Data Reponses, and we have omre than one recipient, +/* If it supports Per-Recipient Data Responses, and we have more than one recipient, request that */ sx->prdr_active = FALSE; @@ -4110,7 +4117,7 @@ connection if there are several waiting, provided we haven't already sent so many as to hit the configured limit. The function transport_check_waiting looks for a waiting message and returns its id. Then transport_pass_socket tries to set up a continued delivery by passing the socket on to another process. The -variable send_rset is FALSE if a message has just been successfully transfered. +variable send_rset is FALSE if a message has just been successfully transferred. If we are already sending down a continued channel, there may be further addresses not yet delivered that are aimed at the same host, but which have not diff --git a/test/README b/test/README index 552b43f2a..a6bcfd897 100644 --- a/test/README +++ b/test/README @@ -1051,7 +1051,7 @@ Lines in client scripts are of several kinds: (7) Otherwise, the line is an input line line that is sent to the server. Any occurrences of \r and \n in the line are turned into carriage return and linefeed, respectively. This is used for testing PIPELINING. - Any sequences of \x followed by two hex digits are converted to the equvalent + Any sequences of \x followed by two hex digits are converted to the equivalent byte value. Any other character following a \ is sent verbatim. The line is sent with a trailing "\r\n". diff --git a/test/aux-fixed/exim-ca/README b/test/aux-fixed/exim-ca/README index 98de5d43d..cb0894640 100755 --- a/test/aux-fixed/exim-ca/README +++ b/test/aux-fixed/exim-ca/README @@ -24,7 +24,7 @@ by that name; those in the "expired" ones are out-of-date (the rest expire in 2038). The "1" and "2" systems/certs have equivalent properties. -In each certicate subdir: the ".db" files are NSS version of the cert, +In each certificate subdir: the ".db" files are NSS version of the cert, the ".pem", ".key" and ".unlocked.key" are usable by OpenSSL (the ca_chain.pem being a copy of the CA public information and signer public information). diff --git a/test/configure b/test/configure index f01a14d74..d6d66b4dc 100755 --- a/test/configure +++ b/test/configure @@ -623,6 +623,7 @@ ac_subst_vars='LTLIBOBJS LIBOBJS LOADED_OPT LOADED +B64_GNUTLS CLIENT_GNUTLS CLIENT_SSL BIND_8_COMPAT @@ -655,6 +656,7 @@ infodir docdir oldincludedir includedir +runstatedir localstatedir sharedstatedir sysconfdir @@ -725,6 +727,7 @@ datadir='${datarootdir}' sysconfdir='${prefix}/etc' sharedstatedir='${prefix}/com' localstatedir='${prefix}/var' +runstatedir='${localstatedir}/run' includedir='${prefix}/include' oldincludedir='/usr/include' docdir='${datarootdir}/doc/${PACKAGE}' @@ -977,6 +980,15 @@ do | -silent | --silent | --silen | --sile | --sil) silent=yes ;; + -runstatedir | --runstatedir | --runstatedi | --runstated \ + | --runstate | --runstat | --runsta | --runst | --runs \ + | --run | --ru | --r) + ac_prev=runstatedir ;; + -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \ + | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \ + | --run=* | --ru=* | --r=*) + runstatedir=$ac_optarg ;; + -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) ac_prev=sbindir ;; -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ @@ -1114,7 +1126,7 @@ fi for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \ datadir sysconfdir sharedstatedir localstatedir includedir \ oldincludedir docdir infodir htmldir dvidir pdfdir psdir \ - libdir localedir mandir + libdir localedir mandir runstatedir do eval ac_val=\$$ac_var # Remove trailing slashes. @@ -1267,6 +1279,7 @@ Fine tuning of the installation directories: --sysconfdir=DIR read-only single-machine data [PREFIX/etc] --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] --localstatedir=DIR modifiable single-machine data [PREFIX/var] + --runstatedir=DIR modifiable per-process data [LOCALSTATEDIR/run] --libdir=DIR object code libraries [EPREFIX/lib] --includedir=DIR C header files [PREFIX/include] --oldincludedir=DIR C header files for non-gcc [/usr/include] @@ -3242,6 +3255,17 @@ fi done +for ac_header in gnutls/gnutls.h +do : + ac_fn_c_check_header_mongrel "$LINENO" "gnutls/gnutls.h" "ac_cv_header_gnutls_gnutls_h" "$ac_includes_default" +if test "x$ac_cv_header_gnutls_gnutls_h" = xyes; then : + cat >>confdefs.h <<_ACEOF +#define HAVE_GNUTLS_GNUTLS_H 1 +_ACEOF + B64_GNUTLS=bin/ed25519_privkey_pem_to_pubkey_raw_b64 +fi + +done diff --git a/test/confs/4060 b/test/confs/4060 index a87c3d6b2..30d65a146 100644 --- a/test/confs/4060 +++ b/test/confs/4060 @@ -3,6 +3,7 @@ CONTROL=* OPT= +CONNECTCOND= keep_environment = PATH exim_path = EXIM_PATH @@ -22,7 +23,7 @@ chunking_advertise_hosts = OPT tls_advertise_hosts = * tls_certificate = ${if eq {SERVER}{server}{DIR/aux-fixed/cert1}fail} -# Avoid ECDHE key-exchange so that we can wireshark-decode +# Avoid ECDHE key-exchange so that we can wireshark-decode (not TLS1.3) .ifdef _HAVE_GNUTLS tls_require_ciphers = NORMAL:-KX-ALL:+RSA .else @@ -30,7 +31,7 @@ tls_require_ciphers = DEFAULT:!kECDHE .endif pipelining_connect_advertise_hosts = * -log_selector = +received_recipients +pipelining +log_selector = +received_recipients +millisec +pipelining queue_only acl_smtp_rcpt = accept @@ -54,6 +55,7 @@ begin transports smtp: driver = smtp + hosts_try_fastopen = CONNECTCOND hosts_pipe_connect = CONTROL tls_verify_hosts = tls_try_verify_hosts = diff --git a/test/confs/4068 b/test/confs/4068 new file mode 120000 index 000000000..f9a2604f2 --- /dev/null +++ b/test/confs/4068 @@ -0,0 +1 @@ +4060
\ No newline at end of file diff --git a/test/confs/4069 b/test/confs/4069 new file mode 120000 index 000000000..f9a2604f2 --- /dev/null +++ b/test/confs/4069 @@ -0,0 +1 @@ +4060
\ No newline at end of file diff --git a/test/confs/4508 b/test/confs/4508 new file mode 100644 index 000000000..dae4a8aba --- /dev/null +++ b/test/confs/4508 @@ -0,0 +1,33 @@ +# Exim test configuration 4508 + +SERVER= + +.include DIR/aux-var/std_conf_prefix + +primary_hostname = myhost.test.ex + +# ----- Main settings ----- + +acl_smtp_rcpt = accept +acl_smtp_dkim = check_dkim +acl_smtp_data = check_data + +log_selector = +dkim_verbose +dkim_verify_signers = DYNAMIC_OPTION + +queue_only +queue_run_in_order + +# ----- ACL --------- + +begin acl + +check_dkim: + accept + logwrite = DKIM: acl called - signer: $dkim_cur_signer bits: $dkim_key_length + +check_data: + accept logwrite = overall \$dkim_verify_status: $dkim_verify_status + logwrite = ${authresults {$primary_hostname}} + +# End diff --git a/test/confs/4520 b/test/confs/4520 index 89769230f..1a8e34f9e 100644 --- a/test/confs/4520 +++ b/test/confs/4520 @@ -14,7 +14,7 @@ acl_smtp_rcpt = accept logwrite = rcpt acl: macro: _DKIM_SIGN_HEADERS acl_smtp_dkim = accept logwrite = dkim_acl: signer: $dkim_cur_signer bits: $dkim_key_length h=$dkim_headernames acl_smtp_data = accept logwrite = data acl: dkim status $dkim_verify_status -dkim_verify_signers = $dkim_signers : FAKE +dkim_verify_signers = $dkim_signers DDIR=DIR/aux-fixed/dkim diff --git a/test/log/4060 b/test/log/4060 index a9e06a3af..7e725a887 100644 --- a/test/log/4060 +++ b/test/log/4060 @@ -1,54 +1,54 @@ -1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for nocache@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmaX-0005vi-00 => nocache@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L C="250 OK id=10HmaY-0005vi-00" -1999-03-02 09:44:33 10HmaX-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for hascache@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmaZ-0005vi-00 => hascache@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L* C="250 OK id=10HmbA-0005vi-00" -1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for clientno@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbB-0005vi-00 => clientno@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L C="250 OK id=10HmbC-0005vi-00" -1999-03-02 09:44:33 10HmbB-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for nocache@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbD-0005vi-00 => nocache@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L K C="250- 3nn byte chunk, total 3nn\\n250 OK id=10HmbE-0005vi-00" -1999-03-02 09:44:33 10HmbD-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmbF-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for chunking@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbF-0005vi-00 => chunking@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L* K C="250- 3nn byte chunk, total 3nn\\n250 OK id=10HmbG-0005vi-00" -1999-03-02 09:44:33 10HmbF-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaX-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for nocache@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaX-0005vi-00 => nocache@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L C="250 OK id=10HmaY-0005vi-00" +2017-07-30 18:51:05.712 10HmaX-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaZ-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for hascache@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaZ-0005vi-00 => hascache@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L* C="250 OK id=10HmbA-0005vi-00" +2017-07-30 18:51:05.712 10HmaZ-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbB-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for clientno@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbB-0005vi-00 => clientno@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L C="250 OK id=10HmbC-0005vi-00" +2017-07-30 18:51:05.712 10HmbB-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbD-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for nocache@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbD-0005vi-00 => nocache@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L K C="250- 3nn byte chunk, total 3nn\\n250 OK id=10HmbE-0005vi-00" +2017-07-30 18:51:05.712 10HmbD-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbF-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for chunking@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbF-0005vi-00 => chunking@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L* K C="250- 3nn byte chunk, total 3nn\\n250 OK id=10HmbG-0005vi-00" +2017-07-30 18:51:05.712 10HmbF-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp ******** SERVER ******** -1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 -1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for nocache@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <nocache@test.ex> R=server -1999-03-02 09:44:33 10HmaY-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L* X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for hascache@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <hascache@test.ex> R=server -1999-03-02 09:44:33 10HmbA-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmbB-0005vi-00@the.local.host.name for clientno@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <clientno@test.ex> R=server -1999-03-02 09:44:33 10HmbC-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 -1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no K S=sss id=E10HmbD-0005vi-00@the.local.host.name for nocache@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbE-0005vi-00 => :blackhole: <nocache@test.ex> R=server -1999-03-02 09:44:33 10HmbE-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmbG-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L* X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no K S=sss id=E10HmbF-0005vi-00@the.local.host.name for chunking@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbG-0005vi-00 => :blackhole: <chunking@test.ex> R=server -1999-03-02 09:44:33 10HmbG-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp +2017-07-30 18:51:05.712 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 +2017-07-30 18:51:05.712 10HmaY-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for nocache@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaY-0005vi-00 => :blackhole: <nocache@test.ex> R=server +2017-07-30 18:51:05.712 10HmaY-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbA-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L* X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for hascache@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbA-0005vi-00 => :blackhole: <hascache@test.ex> R=server +2017-07-30 18:51:05.712 10HmbA-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbC-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmbB-0005vi-00@the.local.host.name for clientno@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbC-0005vi-00 => :blackhole: <clientno@test.ex> R=server +2017-07-30 18:51:05.712 10HmbC-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 +2017-07-30 18:51:05.712 10HmbE-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no K S=sss id=E10HmbD-0005vi-00@the.local.host.name for nocache@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbE-0005vi-00 => :blackhole: <nocache@test.ex> R=server +2017-07-30 18:51:05.712 10HmbE-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbG-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L* X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no K S=sss id=E10HmbF-0005vi-00@the.local.host.name for chunking@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbG-0005vi-00 => :blackhole: <chunking@test.ex> R=server +2017-07-30 18:51:05.712 10HmbG-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp diff --git a/test/log/4062 b/test/log/4062 index 0167e6e26..91c0081a5 100644 --- a/test/log/4062 +++ b/test/log/4062 @@ -1,54 +1,54 @@ -1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for a@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmaX-0005vi-00 => a@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L C="250 OK id=10HmaY-0005vi-00" -1999-03-02 09:44:33 10HmaX-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for b@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmaZ-0005vi-00 => b@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L* C="250 OK id=10HmbA-0005vi-00" -1999-03-02 09:44:33 10HmaZ-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmbB-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for c@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbB-0005vi-00 => c@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L C="250 OK id=10HmbC-0005vi-00" -1999-03-02 09:44:33 10HmbB-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmbD-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for nocache@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbD-0005vi-00 => nocache@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L K C="250- 3nn byte chunk, total 3nn\\n250 OK id=10HmbE-0005vi-00" -1999-03-02 09:44:33 10HmbD-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmbF-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for chunking@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbF-0005vi-00 => chunking@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L* K C="250- 3nn byte chunk, total 3nn\\n250 OK id=10HmbG-0005vi-00" -1999-03-02 09:44:33 10HmbF-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaX-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for a@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaX-0005vi-00 => a@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L C="250 OK id=10HmaY-0005vi-00" +2017-07-30 18:51:05.712 10HmaX-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaZ-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for b@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaZ-0005vi-00 => b@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L* C="250 OK id=10HmbA-0005vi-00" +2017-07-30 18:51:05.712 10HmaZ-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbB-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for c@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbB-0005vi-00 => c@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L C="250 OK id=10HmbC-0005vi-00" +2017-07-30 18:51:05.712 10HmbB-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbD-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for nocache@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbD-0005vi-00 => nocache@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L K C="250- 3nn byte chunk, total 3nn\\n250 OK id=10HmbE-0005vi-00" +2017-07-30 18:51:05.712 10HmbD-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbF-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for chunking@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbF-0005vi-00 => chunking@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L* K C="250- 3nn byte chunk, total 3nn\\n250 OK id=10HmbG-0005vi-00" +2017-07-30 18:51:05.712 10HmbF-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp ******** SERVER ******** -1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 -1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for a@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmaY-0005vi-00 => :blackhole: <a@test.ex> R=server -1999-03-02 09:44:33 10HmaY-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L* X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for b@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbA-0005vi-00 => :blackhole: <b@test.ex> R=server -1999-03-02 09:44:33 10HmbA-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmbC-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmbB-0005vi-00@the.local.host.name for c@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbC-0005vi-00 => :blackhole: <c@test.ex> R=server -1999-03-02 09:44:33 10HmbC-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 -1999-03-02 09:44:33 10HmbE-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no K S=sss id=E10HmbD-0005vi-00@the.local.host.name for nocache@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbE-0005vi-00 => :blackhole: <nocache@test.ex> R=server -1999-03-02 09:44:33 10HmbE-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp -1999-03-02 09:44:33 10HmbG-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L* X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no K S=sss id=E10HmbF-0005vi-00@the.local.host.name for chunking@test.ex -1999-03-02 09:44:33 Start queue run: pid=pppp -1999-03-02 09:44:33 10HmbG-0005vi-00 => :blackhole: <chunking@test.ex> R=server -1999-03-02 09:44:33 10HmbG-0005vi-00 Completed -1999-03-02 09:44:33 End queue run: pid=pppp +2017-07-30 18:51:05.712 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 +2017-07-30 18:51:05.712 10HmaY-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for a@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaY-0005vi-00 => :blackhole: <a@test.ex> R=server +2017-07-30 18:51:05.712 10HmaY-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbA-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L* X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for b@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbA-0005vi-00 => :blackhole: <b@test.ex> R=server +2017-07-30 18:51:05.712 10HmbA-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbC-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmbB-0005vi-00@the.local.host.name for c@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbC-0005vi-00 => :blackhole: <c@test.ex> R=server +2017-07-30 18:51:05.712 10HmbC-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 +2017-07-30 18:51:05.712 10HmbE-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no K S=sss id=E10HmbD-0005vi-00@the.local.host.name for nocache@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbE-0005vi-00 => :blackhole: <nocache@test.ex> R=server +2017-07-30 18:51:05.712 10HmbE-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbG-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L* X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no K S=sss id=E10HmbF-0005vi-00@the.local.host.name for chunking@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbG-0005vi-00 => :blackhole: <chunking@test.ex> R=server +2017-07-30 18:51:05.712 10HmbG-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp diff --git a/test/log/4068 b/test/log/4068 new file mode 100644 index 000000000..8f487c900 --- /dev/null +++ b/test/log/4068 @@ -0,0 +1,44 @@ +2017-07-30 18:51:05.712 10HmaX-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for a@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaX-0005vi-00 => a@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L C="250 OK id=10HmaY-0005vi-00" +2017-07-30 18:51:05.712 10HmaX-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaZ-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for b@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaZ-0005vi-00 => b@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] TFO* X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L* C="250 OK id=10HmbA-0005vi-00" +2017-07-30 18:51:05.712 10HmaZ-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbB-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for nocache@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbB-0005vi-00 => nocache@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L K C="250- 3nn byte chunk, total 3nn\\n250 OK id=10HmbC-0005vi-00" +2017-07-30 18:51:05.712 10HmbB-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbD-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for chunking@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbD-0005vi-00 => chunking@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] TFO* X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no L* K C="250- 3nn byte chunk, total 3nn\\n250 OK id=10HmbE-0005vi-00" +2017-07-30 18:51:05.712 10HmbD-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp + +******** SERVER ******** +2017-07-30 18:51:05.712 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 +2017-07-30 18:51:05.712 10HmaY-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for a@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaY-0005vi-00 => :blackhole: <a@test.ex> R=server +2017-07-30 18:51:05.712 10HmaY-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbA-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] TFO* P=esmtps L* X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for b@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbA-0005vi-00 => :blackhole: <b@test.ex> R=server +2017-07-30 18:51:05.712 10HmbA-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 +2017-07-30 18:51:05.712 10HmbC-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no K S=sss id=E10HmbB-0005vi-00@the.local.host.name for nocache@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbC-0005vi-00 => :blackhole: <nocache@test.ex> R=server +2017-07-30 18:51:05.712 10HmbC-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbE-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] TFO* P=esmtps L* X=TLS1.x:ke-RSA-AES256-SHAnnn:xxx CV=no K S=sss id=E10HmbD-0005vi-00@the.local.host.name for chunking@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbE-0005vi-00 => :blackhole: <chunking@test.ex> R=server +2017-07-30 18:51:05.712 10HmbE-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp diff --git a/test/log/4069 b/test/log/4069 new file mode 100644 index 000000000..924da2969 --- /dev/null +++ b/test/log/4069 @@ -0,0 +1,44 @@ +2017-07-30 18:51:05.712 10HmaX-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for a@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaX-0005vi-00 => a@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no L C="250 OK id=10HmaY-0005vi-00" +2017-07-30 18:51:05.712 10HmaX-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaZ-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for b@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaZ-0005vi-00 => b@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] TFO* X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no L* C="250 OK id=10HmbA-0005vi-00" +2017-07-30 18:51:05.712 10HmaZ-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbB-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for wrongcache@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbB-0005vi-00 => wrongcache@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] TFO* X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no L* C="250 OK id=10HmbC-0005vi-00" +2017-07-30 18:51:05.712 10HmbB-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbD-0005vi-00 <= CALLER@the.local.host.name U=CALLER P=local S=sss for chunking@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbD-0005vi-00 => chunking@test.ex R=client T=smtp H=127.0.0.1 [127.0.0.1] TFO* X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no L* K C="250- 3nn byte chunk, total 3nn\\n250 OK id=10HmbE-0005vi-00" +2017-07-30 18:51:05.712 10HmbD-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp + +******** SERVER ******** +2017-07-30 18:51:05.712 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 +2017-07-30 18:51:05.712 10HmaY-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] P=esmtps L. X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmaX-0005vi-00@the.local.host.name for a@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmaY-0005vi-00 => :blackhole: <a@test.ex> R=server +2017-07-30 18:51:05.712 10HmaY-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbA-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] TFO* P=esmtps L* X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmaZ-0005vi-00@the.local.host.name for b@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbA-0005vi-00 => :blackhole: <b@test.ex> R=server +2017-07-30 18:51:05.712 10HmbA-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 +2017-07-30 18:51:05.712 10HmbC-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] TFO* P=esmtps L* X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no S=sss id=E10HmbB-0005vi-00@the.local.host.name for wrongcache@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbC-0005vi-00 => :blackhole: <wrongcache@test.ex> R=server +2017-07-30 18:51:05.712 10HmbC-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbE-0005vi-00 <= CALLER@the.local.host.name H=localhost (the.local.host.name) [127.0.0.1] TFO* P=esmtps L* X=TLSv1:ke-RSA-AES256-SHA:xxx CV=no K S=sss id=E10HmbD-0005vi-00@the.local.host.name for chunking@test.ex +2017-07-30 18:51:05.712 Start queue run: pid=pppp +2017-07-30 18:51:05.712 10HmbE-0005vi-00 => :blackhole: <chunking@test.ex> R=server +2017-07-30 18:51:05.712 10HmbE-0005vi-00 Completed +2017-07-30 18:51:05.712 End queue run: pid=pppp diff --git a/test/log/4508 b/test/log/4508 new file mode 100644 index 000000000..4a031f285 --- /dev/null +++ b/test/log/4508 @@ -0,0 +1,25 @@ + +******** SERVER ******** +1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 +1999-03-02 09:44:33 10HmaX-0005vi-00 DKIM: acl called - signer: test.ex bits: 1024 +1999-03-02 09:44:33 10HmaX-0005vi-00 DKIM: d=test.ex s=sel c=simple/simple a=rsa-sha256 b=1024 [verification succeeded] +1999-03-02 09:44:33 10HmaX-0005vi-00 overall $dkim_verify_status: pass +1999-03-02 09:44:33 10HmaX-0005vi-00 Authentication-Results: myhost.test.ex;\n dkim=pass header.d=test.ex header.s=sel header.a=rsa-sha256 +1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss DKIM=test.ex id=qwerty1234@disco-zombie.net +1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 +1999-03-02 09:44:33 10HmaY-0005vi-00 DKIM: d=test.ex s=sel c=simple/simple a=rsa-sha256 b=1024 [verification succeeded] +1999-03-02 09:44:33 10HmaY-0005vi-00 overall $dkim_verify_status: +1999-03-02 09:44:33 10HmaY-0005vi-00 Authentication-Results: myhost.test.ex;\n dkim=pass header.d=test.ex header.s=sel header.a=rsa-sha256 +1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss DKIM=test.ex id=qwerty1234@disco-zombie.net +1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 +1999-03-02 09:44:33 10HmaZ-0005vi-00 DKIM: acl called - signer: nothere.example.com bits: 0 +1999-03-02 09:44:33 10HmaZ-0005vi-00 overall $dkim_verify_status: none +1999-03-02 09:44:33 10HmaZ-0005vi-00 Authentication-Results: myhost.test.ex;\n dkim=pass header.d=test.ex header.s=sel header.a=rsa-sha256 +1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss id=qwerty1234@disco-zombie.net +1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225 +1999-03-02 09:44:33 10HmbA-0005vi-00 DKIM: acl called - signer: test.ex bits: 1024 +1999-03-02 09:44:33 10HmbA-0005vi-00 DKIM: d=test.ex s=sel c=simple/simple a=rsa-sha256 b=1024 [verification succeeded] +1999-03-02 09:44:33 10HmbA-0005vi-00 DKIM: acl called - signer: different.example.com bits: 1024 +1999-03-02 09:44:33 10HmbA-0005vi-00 overall $dkim_verify_status: pass:none +1999-03-02 09:44:33 10HmbA-0005vi-00 Authentication-Results: myhost.test.ex;\n dkim=pass header.d=test.ex header.s=sel header.a=rsa-sha256 +1999-03-02 09:44:33 10HmbA-0005vi-00 <= CALLER@bloggs.com H=(xxx) [127.0.0.1] P=smtp S=sss DKIM=test.ex id=qwerty1234@disco-zombie.net diff --git a/test/paniclog/0415 b/test/paniclog/0415 index 68a0f4491..8ab0c2cb9 100644 --- a/test/paniclog/0415 +++ b/test/paniclog/0415 @@ -1,5 +1,5 @@ 1999-03-02 09:44:33 Exim configuration error in line 15 of TESTSUITE/test-config: - absolute value of integer "4000E" is too large (overflow) + absolute value of integer "4000Z" is too large (overflow) 1999-03-02 09:44:33 Exim configuration error in line 15 of TESTSUITE/test-config: extra characters follow integer value for check_spool_space 1999-03-02 09:44:33 Exim configuration error in line 16 of TESTSUITE/test-config: diff --git a/test/runtest b/test/runtest index d76b25370..d52facc7a 100755 --- a/test/runtest +++ b/test/runtest @@ -608,7 +608,6 @@ RESET_AFTER_EXTRA_LINE_READ: # TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256 # TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128 # TLS1.2:RSA_AES_256_CBC_SHA1:256 (canonical) - # TLS1.2:RSA_AES_128_GCM_SHA256:128 # TLS1.2:DHE_RSA_AES_128_CBC_SHA1:128 # # X=TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256 @@ -621,7 +620,7 @@ RESET_AFTER_EXTRA_LINE_READ: # DHE-RSA-AES256-SHA # picking latter as canonical simply because regex easier that way. s/\bDHE_RSA_AES_128_CBC_SHA1:128/RSA-AES256-SHA1:256/g; - s/TLS1.[0-3]:((EC)?DHE_)?(RSA|ECDSA)_AES_(256|128)_(CBC|GCM)_SHA(1|256|384):(256|128)/TLS1.x:ke-$3-AES256-SHAnnn:xxx/g; + s/TLS1.[0123]:((EC)?DHE_)?(RSA|ECDSA)_AES_(256|128)_(CBC|GCM)_SHA(1|256|384):(256|128)/TLS1.x:ke-$3-AES256-SHAnnn:xxx/g; s/\b(ECDHE-(RSA|ECDSA)-AES256-SHA|DHE-RSA-AES256-SHA256)\b/ke-$2-AES256-SHAnnn/g; # GnuTLS library error message changes @@ -2216,7 +2215,7 @@ elsif (/^millisleep\s+(.*)$/) # The "munge" command selects one of a hardwired set of test-result modifications -# to be made before result compares are run agains the golden set. This lets +# to be made before result compares are run against the golden set. This lets # us account for test-system dependent things which only affect a few, but known, # test-cases. # Currently only the last munge takes effect. diff --git a/test/scripts/0000-Basic/0415 b/test/scripts/0000-Basic/0415 index 09f582b62..411efac16 100644 --- a/test/scripts/0000-Basic/0415 +++ b/test/scripts/0000-Basic/0415 @@ -1,6 +1,6 @@ # overflow in integer options 1 -exim -DARG1=4000E -bP check_spool_space +exim -DARG1=4000Z -bP check_spool_space **** exim -DARG1=4000G -bP check_spool_space **** diff --git a/test/scripts/4068-pipe-conn-gnutls-tfo/4068 b/test/scripts/4068-pipe-conn-gnutls-tfo/4068 new file mode 100644 index 000000000..9a454391a --- /dev/null +++ b/test/scripts/4068-pipe-conn-gnutls-tfo/4068 @@ -0,0 +1,60 @@ +# early-pipe, starttls, tfo +# +# Not attempted without a cache entry +exim -bd -DSERVER=server -oX PORT_D +**** +# +exim a@test.ex +Subject test 1 + +**** +exim -DCONNECTCOND=127.0.0.1 -q +**** +exim -DNOTDAEMON -DSERVER=server -q +**** +# +# +# +# Go for it. This one should do early-pipelinng. +exim b@test.ex +Subject test 2 + +**** +exim -DCONNECTCOND=127.0.0.1 -q +**** +exim -DNOTDAEMON -DSERVER=server -q +**** +# +# +killdaemon +# +# +# And again with CHUNKING +sudo rm DIR/spool/db/misc +exim -bd -DSERVER=server -DOPT=* -oX PORT_D +**** +# +exim nocache@test.ex +Subject test 4 + +**** +exim -DCONNECTCOND=127.0.0.1 -q +**** +exim -DNOTDAEMON -DSERVER=server -q +**** +# +# +# +# Go for it +exim chunking@test.ex +Subject test 5 + +**** +exim -DCONNECTCOND=127.0.0.1 -q +**** +exim -DNOTDAEMON -DSERVER=server -q +**** +# +killdaemon +# +no_msglog_check diff --git a/test/scripts/4068-pipe-conn-gnutls-tfo/REQUIRES b/test/scripts/4068-pipe-conn-gnutls-tfo/REQUIRES new file mode 100644 index 000000000..0cfd46cac --- /dev/null +++ b/test/scripts/4068-pipe-conn-gnutls-tfo/REQUIRES @@ -0,0 +1,3 @@ +support Experimental_PIPE_CONNECT +support GnuTLS +support TCP_Fast_Open diff --git a/test/scripts/4069-pipe-conn-openssl-tfo/4069 b/test/scripts/4069-pipe-conn-openssl-tfo/4069 new file mode 100644 index 000000000..2339b0c12 --- /dev/null +++ b/test/scripts/4069-pipe-conn-openssl-tfo/4069 @@ -0,0 +1,70 @@ +# early-pipe, starttls, tfo +# +# Network delay so we can see tfo efects +# Clear any previously-obtained tfo cookie: +sudo perl +system ("tc qdisc add dev lo root netem delay 50ms"); +system ("ip tcp_metrics delete 127.0.0.1"); +**** +# +# +# Early-pipe not attempted without a cache entry +exim -bd -DSERVER=server -oX PORT_D +**** +# +exim a@test.ex +Subject test 1 + +**** +exim -DCONNECTCOND=127.0.0.1 -q +**** +exim -DNOTDAEMON -DSERVER=server -q +**** +# +# +# +# Go for it. This one should do early-pipelinng. +exim b@test.ex +Subject test 2 + +**** +exim -DCONNECTCOND=127.0.0.1 -q +**** +exim -DNOTDAEMON -DSERVER=server -q +**** +# +# +killdaemon +# +# +# And again with CHUNKING +# +exim -bd -DSERVER=server -DOPT=* -oX PORT_D +**** +# +# First try has wrong cached info for chunking. Get it refreshed. +exim wrongcache@test.ex +Subject test 4 + +**** +exim -DCONNECTCOND=127.0.0.1 -q +**** +exim -DNOTDAEMON -DSERVER=server -q +**** +# +# Go for it +exim chunking@test.ex +Subject test 5 + +**** +exim -DCONNECTCOND=127.0.0.1 -q +**** +exim -DNOTDAEMON -DSERVER=server -q +**** +# +killdaemon +# +sudo perl +system ("tc qdisc delete dev lo root"); +**** +no_msglog_check diff --git a/test/scripts/4069-pipe-conn-openssl-tfo/REQUIRES b/test/scripts/4069-pipe-conn-openssl-tfo/REQUIRES new file mode 100644 index 000000000..be856b0d6 --- /dev/null +++ b/test/scripts/4069-pipe-conn-openssl-tfo/REQUIRES @@ -0,0 +1,3 @@ +support Experimental_PIPE_CONNECT +support OpenSSL +support TCP_Fast_Open diff --git a/test/scripts/4500-DKIM/4508 b/test/scripts/4500-DKIM/4508 new file mode 100644 index 000000000..b9eaabe05 --- /dev/null +++ b/test/scripts/4500-DKIM/4508 @@ -0,0 +1,149 @@ +# DKIM verify, dkim_verify_signers option +# +exim -DSERVER=server -DDYNAMIC_OPTION='$dkim_signers' -bd -oX PORT_D +**** +# +# Same as default. This should pass. +# - sha256, 1024b +# Mail original in aux-fixed/4500.msg1.txt +# Sig generated by: perl aux-fixed/dkim/sign.pl --algorithm=rsa-sha256 \ +# --method=simple/simple < aux-fixed/4500.msg1.txt +client 127.0.0.1 PORT_D +??? 220 +HELO xxx +??? 250 +MAIL FROM:<CALLER@bloggs.com> +??? 250 +RCPT TO:<a@test.ex> +??? 250 +DATA +??? 354 +DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=test.ex; h=from:to + :date:message-id:subject; s=sel; bh=3UbbJTudPxmejzh7U1Zg33U3QT+1 + 6kfV2eOTvMeiEis=; b=xQSD/JMqz0C+xKf0A1NTkPTbkDuDdJbpBuyjjT9iYvyP + Zez+xl0TkoPobFGVa6EN8+ZeYV18zjifhtWYLSsNmPinUtcpKQLG1zxAKmmS0JEh + +qihlWbeGJ5+tK588ugUzXHPj+4JBW0H6kxHvdH0l2SlQE5xs/cdggnx5QX5USY= +From: mrgus@text.ex +To: bakawolf@yahoo.com +Date: Thu, 19 Nov 2015 17:00:07 -0700 +Message-ID: <qwerty1234@disco-zombie.net> +Subject: simple test + +This is a simple test. +. +??? 250 +QUIT +??? 221 +**** +killdaemon +# +exim -DSERVER=server -DDYNAMIC_OPTION='' -bd -oX PORT_D +**** +# Empty. Should avoid calling dkim ACL. +# - sha256, 1024b +# Mail original in aux-fixed/4500.msg1.txt +# Sig generated by: perl aux-fixed/dkim/sign.pl --algorithm=rsa-sha256 \ +# --method=simple/simple < aux-fixed/4500.msg1.txt +client 127.0.0.1 PORT_D +??? 220 +HELO xxx +??? 250 +MAIL FROM:<CALLER@bloggs.com> +??? 250 +RCPT TO:<a@test.ex> +??? 250 +DATA +??? 354 +DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=test.ex; h=from:to + :date:message-id:subject; s=sel; bh=3UbbJTudPxmejzh7U1Zg33U3QT+1 + 6kfV2eOTvMeiEis=; b=xQSD/JMqz0C+xKf0A1NTkPTbkDuDdJbpBuyjjT9iYvyP + Zez+xl0TkoPobFGVa6EN8+ZeYV18zjifhtWYLSsNmPinUtcpKQLG1zxAKmmS0JEh + +qihlWbeGJ5+tK588ugUzXHPj+4JBW0H6kxHvdH0l2SlQE5xs/cdggnx5QX5USY= +From: mrgus@text.ex +To: bakawolf@yahoo.com +Date: Thu, 19 Nov 2015 17:00:07 -0700 +Message-ID: <qwerty1234@disco-zombie.net> +Subject: simple test + +This is a simple test. +. +??? 250 +QUIT +??? 221 +**** +killdaemon +# +exim -DSERVER=server -DDYNAMIC_OPTION='nothere.example.com' -bd -oX PORT_D +**** +# Different domain. Should fail DKIM verify. +# - sha256, 1024b +# Mail original in aux-fixed/4500.msg1.txt +# Sig generated by: perl aux-fixed/dkim/sign.pl --algorithm=rsa-sha256 \ +# --method=simple/simple < aux-fixed/4500.msg1.txt +client 127.0.0.1 PORT_D +??? 220 +HELO xxx +??? 250 +MAIL FROM:<CALLER@bloggs.com> +??? 250 +RCPT TO:<a@test.ex> +??? 250 +DATA +??? 354 +DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=test.ex; h=from:to + :date:message-id:subject; s=sel; bh=3UbbJTudPxmejzh7U1Zg33U3QT+1 + 6kfV2eOTvMeiEis=; b=xQSD/JMqz0C+xKf0A1NTkPTbkDuDdJbpBuyjjT9iYvyP + Zez+xl0TkoPobFGVa6EN8+ZeYV18zjifhtWYLSsNmPinUtcpKQLG1zxAKmmS0JEh + +qihlWbeGJ5+tK588ugUzXHPj+4JBW0H6kxHvdH0l2SlQE5xs/cdggnx5QX5USY= +From: mrgus@text.ex +To: bakawolf@yahoo.com +Date: Thu, 19 Nov 2015 17:00:07 -0700 +Message-ID: <qwerty1234@disco-zombie.net> +Subject: simple test + +This is a simple test. +. +??? 250 +QUIT +??? 221 +**** +killdaemon +# +exim -DSERVER=server -DDYNAMIC_OPTION='test.ex : different.example.com' -bd -oX PORT_D +**** +# Mixed set. Should get one DKIM verify pass. +# - sha256, 1024b +# Mail original in aux-fixed/4500.msg1.txt +# Sig generated by: perl aux-fixed/dkim/sign.pl --algorithm=rsa-sha256 \ +# --method=simple/simple < aux-fixed/4500.msg1.txt +client 127.0.0.1 PORT_D +??? 220 +HELO xxx +??? 250 +MAIL FROM:<CALLER@bloggs.com> +??? 250 +RCPT TO:<a@test.ex> +??? 250 +DATA +??? 354 +DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=test.ex; h=from:to + :date:message-id:subject; s=sel; bh=3UbbJTudPxmejzh7U1Zg33U3QT+1 + 6kfV2eOTvMeiEis=; b=xQSD/JMqz0C+xKf0A1NTkPTbkDuDdJbpBuyjjT9iYvyP + Zez+xl0TkoPobFGVa6EN8+ZeYV18zjifhtWYLSsNmPinUtcpKQLG1zxAKmmS0JEh + +qihlWbeGJ5+tK588ugUzXHPj+4JBW0H6kxHvdH0l2SlQE5xs/cdggnx5QX5USY= +From: mrgus@text.ex +To: bakawolf@yahoo.com +Date: Thu, 19 Nov 2015 17:00:07 -0700 +Message-ID: <qwerty1234@disco-zombie.net> +Subject: simple test + +This is a simple test. +. +??? 250 +QUIT +??? 221 +**** +killdaemon +# +no_stdout_check +no_msglog_check diff --git a/test/stderr/0415 b/test/stderr/0415 index 429262094..211d7323b 100644 --- a/test/stderr/0415 +++ b/test/stderr/0415 @@ -1,6 +1,6 @@ LOG: PANIC DIE Exim configuration error in line 15 of TESTSUITE/test-config: - absolute value of integer "4000E" is too large (overflow) + absolute value of integer "4000Z" is too large (overflow) LOG: PANIC DIE Exim configuration error in line 15 of TESTSUITE/test-config: extra characters follow integer value for check_spool_space diff --git a/test/stderr/4052 b/test/stderr/4052 index 64f8b9e21..3b9772c5c 100644 --- a/test/stderr/4052 +++ b/test/stderr/4052 @@ -38,7 +38,8 @@ smtp_reap_early_pipe expect ehlo 250-X_PIPE_CONNECT 250-STARTTLS 250 ok -EHLO extensions changed, 0x0220/0x0000 -> 0x0221/0x0000 +EHLO cleartext extensions changed, 0x0220/0x0000 -> 0x0221/0x0000 +writing clr 0221/0000 cry 0000/0000 sync_responses expect mail SMTP<< 250 mail-from accepted sync_responses expect rcpt diff --git a/test/stdout/0415 b/test/stdout/0415 index 7215cca80..619f9f373 100644 --- a/test/stdout/0415 +++ b/test/stdout/0415 @@ -1,4 +1,4 @@ -check_spool_space = 4096000G +check_spool_space = 4000G queue_only_load = 2000000.123 finduser_retries = 0 finduser_retries = 999999999 |