head 1.2; access; symbols pkgsrc-2023Q4:1.2.0.34 pkgsrc-2023Q4-base:1.2 pkgsrc-2023Q3:1.2.0.32 pkgsrc-2023Q3-base:1.2 pkgsrc-2023Q2:1.2.0.30 pkgsrc-2023Q2-base:1.2 pkgsrc-2023Q1:1.2.0.28 pkgsrc-2023Q1-base:1.2 pkgsrc-2022Q4:1.2.0.26 pkgsrc-2022Q4-base:1.2 pkgsrc-2022Q3:1.2.0.24 pkgsrc-2022Q3-base:1.2 pkgsrc-2022Q2:1.2.0.22 pkgsrc-2022Q2-base:1.2 pkgsrc-2022Q1:1.2.0.20 pkgsrc-2022Q1-base:1.2 pkgsrc-2021Q4:1.2.0.18 pkgsrc-2021Q4-base:1.2 pkgsrc-2021Q3:1.2.0.16 pkgsrc-2021Q3-base:1.2 pkgsrc-2021Q2:1.2.0.14 pkgsrc-2021Q2-base:1.2 pkgsrc-2021Q1:1.2.0.12 pkgsrc-2021Q1-base:1.2 pkgsrc-2020Q4:1.2.0.10 pkgsrc-2020Q4-base:1.2 pkgsrc-2020Q3:1.2.0.8 pkgsrc-2020Q3-base:1.2 pkgsrc-2020Q2:1.2.0.6 pkgsrc-2020Q2-base:1.2 pkgsrc-2020Q1:1.2.0.2 pkgsrc-2020Q1-base:1.2 pkgsrc-2019Q4:1.2.0.4 pkgsrc-2019Q4-base:1.2 pkgsrc-2019Q3:1.1.0.24 pkgsrc-2019Q3-base:1.1 pkgsrc-2019Q2:1.1.0.22 pkgsrc-2019Q2-base:1.1 pkgsrc-2019Q1:1.1.0.20 pkgsrc-2019Q1-base:1.1 pkgsrc-2018Q4:1.1.0.18 pkgsrc-2018Q4-base:1.1 pkgsrc-2018Q3:1.1.0.16 pkgsrc-2018Q3-base:1.1 pkgsrc-2018Q2:1.1.0.14 pkgsrc-2018Q2-base:1.1 pkgsrc-2018Q1:1.1.0.12 pkgsrc-2018Q1-base:1.1 pkgsrc-2017Q4:1.1.0.10 pkgsrc-2017Q4-base:1.1 pkgsrc-2017Q3:1.1.0.8 pkgsrc-2017Q3-base:1.1 pkgsrc-2017Q2:1.1.0.4 pkgsrc-2017Q2-base:1.1 pkgsrc-2017Q1:1.1.0.2 pkgsrc-2017Q1-base:1.1; locks; strict; comment @# @; 1.2 date 2019.12.09.18.46.00; author adam; state Exp; branches; next 1.1; commitid 5pSLddULU7EBX3OB; 1.1 date 2017.03.18.07.08.23; author adam; state Exp; branches; next ; commitid wn8hiY0Mb2Zl70Kz; desc @@ 1.2 log @exim: updated to 4.93 Exim version 4.93 ----------------- JH/01 OpenSSL: With debug enabled output keying information sufficient, server side, to decode a TLS 1.3 packet capture. JH/02 OpenSSL: Suppress the sending of (stateful) TLS1.3 session tickets. Previously the default library behaviour applied, sending two, each in its own TCP segment. JH/03 Debug output for ACL now gives the config file name and line number for each verb. JH/04 The default received_header_text now uses the RFC 8314 tls cipher clause. JH/05 DKIM: ensure that dkim_domain elements are lowercased before use. JH/06 Fix buggy handling of autoreply bounce_return_size_limit, and a possible buffer overrun for (non-chunking) other transports. JH/07 GnuTLS: Our use of late (post-handshake) certificate verification, under TLS1.3, means that a server rejecting a client certificate is not visible to the client until the first read of encrypted data (typically the response to EHLO). Add detection for that case and treat it as a failed TLS connection attempt, so that the normal retry-in-clear can work (if suitably configured). JB/01 Bug 2375: fix expansions of 822 addresses having comments in local-part and/or domain. Found and fixed by Jason Betts. JH/08 Add hardening against SRV & TLSA lookups the hit CNAMEs (a nonvalid configuration). If a CNAME target was not a wellformed name pattern, a crash could result. JH/09 Logging: Fix initial listening-on line for multiple ports for an IP when the OS reports them interleaved with other addresses. JH/10 OpenSSL: Fix aggregation of messages. Previously, when PIPELINING was used both for input and for a verify callout, both encrypted, SMTP responses being sent by the server could be lost. This resulted in dropped connections and sometimes bounces generated by a peer sending to this system. JH/11 Harden plaintext authenticator against a badly misconfigured client-send string. Previously it was possible to cause undefined behaviour in a library routine (usually a crash). Found by "zerons". JH/12 Bug 2384: fix "-bP smtp_receive_timeout". Previously it returned no output. JH/13 Bug 2386: Fix builds with Dane under LibreSSL 2.9.0 onward. Some old API was removed, so update to use the newer ones. JH/14 Bug 1891: Close the log file if receiving a non-smtp message, without any timeout set, is taking a long time. Previously we would hang on to a rotated logfile "forever" if the input was arriving with long gaps (a previous attempt to fix addressed lack, for a long time, of initial input). HS/01 Bug 2390: Use message_id for tempfile creation to avoid races in a shared (NFS) environment. The length of the tempfile name is now 4 + 16 ("hdr.$message_exim_id") which might break on file systems which restrict the file name length to lower values. (It was "hdr.$pid".) HS/02 Bug 2390: Use message_id for tempfile creation to avoid races in a shared (NFS) environment. HS/03 Bug 2392: exigrep does case sensitive *option* processing (as it did for all versions <4.90). Notably -M, -m, --invert, -I may be affected. JH/15 Use unsigned when creating bitmasks in macros, to avoid build errors on some platforms for bit 31. JH/16 GnuTLS: rework ciphersuite strings under recent library versions. Thanks to changes apparently associated with TLS1.3 handling some of the APIs previously used were either nonfunctional or inappropriate. Strings like TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM__AEAD:256 and TLS1.2:ECDHE_SECP256R1__RSA_SHA256__AES_128_CBC__SHA256:128 replace the previous TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256 . This affects log line X= elements, the $tls_{in,out}_cipher variables, and the use of specific cipher names in the encrypted= ACL condition. JH/17 OpenSSL: the default openssl_options now disables ssl_v3. JH/18 GnuTLS: fix $tls_out_ocsp under hosts_request_ocsp. Previously the verification result was not updated unless hosts_require_ocsp applied. JH/19 Bug 2398: fix listing of a named-queue. Previously, even with the option queue_list_requires_admin set to false, non-admin users were denied the facility. JH/20 Bug 2389: fix server advertising of usable certificates, under GnuTLS in directory-of-certs mode. Previously they were advertised despite the documentation. JH/21 The smtp transport option "hosts_noproxy_tls" is now unset by default. A single TCP connection by a client will now hold a TLS connection open for multiple message deliveries, by default. Previoud the default was to not do so. JH/22 The smtp transport option "hosts_try_dane" now enables all hosts by default. If built with the facility, DANE will be used. The facility SUPPORT_DANE is now enabled in the prototype build Makefile "EDITME". JH/23 The build default is now for TLS to be included; the SUPPORT_TLS define is replaced with DISABLE_TLS. Either USE_GNUTLS or (the new) USE_OPENSSL must be defined and you must still, unless you define DISABLE_TLS, manage the the include-dir and library-file requirements that go with that choice. Non-TLS builds are still supported. JH/24 Fix duplicated logging of peer name/address, on a transport connection- reject under TFO. JH/25 The smtp transport option "hosts_try_fastopen" now enables all hosts by default. If the platform supports and has the facility enabled, it will be requested on all coneections. JH/26 The PIPE_CONNECT facility is promoted from experimental status and is now controlled by the build-time option SUPPORT_PIPE_CONNECT. PP/01 Unbreak heimdal_gssapi, broken in 4.92. JH/27 Bug 2404: Use the main-section configuration option "dsn_from" for success-DSN messages. Previously the From: header was always the default one for these; the option was ignored. JH/28 Fix the timeout on smtp response to apply to the whole response. Previously it was reset for every read, so a teergrubing peer sending single bytes within the time limit could extend the connection for a long time. Credit to Qualsys Security Advisory Team for the discovery. JH/29 Fix DSN Final-Recipient: field. Previously it was the post-routing delivery address, which leaked information of the results of local forwarding. Change to the original envelope recipient address, per standards. JH/30 Bug 2411: Fix DSN generation when RFC 3461 failure notification is requested. Previously not bounce was generated and a log entry of error ignored was made. JH/31 Avoid re-expansion in ${sort } expansion. (CVE-2019-13917) JH/32 Introduce a general tainting mechanism for values read from the input channel, and values derived from them. Refuse to expand any tainted values, to catch one form of exploit. JH/33 Bug 2413: Fix dkim_strict option. Previously the expansion result was unused and the unexpanded text used for the test. Found and fixed by Ruben Jenster. JH/34 Fix crash after TLS shutdown. When the TCP/SMTP channel was left open, an attempt to use a TLS library read routine dereffed a nul pointer, causing a segfault. JH/35 Bug 2409: filter out-of-spec chars from callout response before using them in our smtp response. JH/36 Have the general router option retry_use_local_part default to true when any of the restrictive preconditions are set (to anything). Previously it was only for check_local user. The change removes one item of manual configuration which is required for proper retries when a remote router handles a subset of addresses for a domain. JH/37 Appendfile: when evaluating quota use (non-quota_size_regex) take the file link count into consideration. HS/04 Fix handling of very log lines in -H files. If a - line caused the extension of big_buffer, the following lines were ignored. JH/38 Bug 1395: Teach the DNS negative-cache about TTL value from the SOA in accordance with RFC 2308. Previously there was no expiry, so a longlived receive process (eg. due to ACL delays) versus a short SOA value could surprise. HS/05 Handle trailing backslash gracefully. (CVE-2019-15846) JH/39 Promote DMARC support to mainline. JH/40 Bug 2452: Add a References: header to DSNs. JH/41 With GnuTLS 3.6.0 (and later) do not attempt to manage Diffie-Hellman parameters. The relevant library call is documented as "Deprecated: This function is unnecessary and discouraged on GnuTLS 3.6.0 or later. Since 3.6.0, DH parameters are negotiated following RFC7919." HS/06 Change the default of dnssec_request_domains to "*" JH/42 Bug 2545: Fix CHUNKING for all RCPT commands rejected. Previously we carried on and emitted a BDAT command, even when PIPELINING was not active. JH/43 Bug 2465: Fix taint-handling in dsearch lookup. Previously a nontainted buffer was used for the filename, resulting in a trap when tainted arguments (eg. $domain) were used. JH/44 With OpenSSL 1.1.1 (onwards) disable renegotiation for TLS1.2 and below; recommended to avoid a possible server-load attack. The feature can be re-enabled via the openssl_options main cofiguration option. JH/45 local_scan API: documented the current smtp_printf() call. This changed for version 4.90 - adding a "more data" boolean to the arguments. Bumped the ABI version number also, this having been missed previously; release versions 4.90 to 4.92.3 inclusive were effectively broken in respect of usage of smtp_printf() by either local_scan code or libraries accessed via the ${dlfunc } expansion item. Both will need coding adjustment for any calls to smtp_printf() to match the new function signature; a FALSE value for the new argument is always safe. JH/46 FreeBSD: fix use of the sendfile() syscall. The shim was not updating the file-offset (which the Linux syscall does, and exim expects); this resulted in an indefinite loop. JH/47 ARC: fix crash in signing, triggered when a configuration error failed to do ARC verification. The Authentication-Results: header line added by the configuration then had no ARC item. @ text @$NetBSD$ --- Local/Makefile.pkgsrc.orig 2019-12-09 08:46:14.000000000 +0000 +++ Local/Makefile.pkgsrc @@@@ -100,7 +100,7 @@@@ # /usr/local/sbin. The installation script will try to create this directory, # and any superior directories, if they do not exist. -BIN_DIRECTORY=/usr/exim/bin +BIN_DIRECTORY=@@PREFIX@@/sbin #------------------------------------------------------------------------------ @@@@ -116,7 +116,7 @@@@ BIN_DIRECTORY=/usr/exim/bin # don't exist. It will also install a default runtime configuration if this # file does not exist. -CONFIGURE_FILE=/usr/exim/configure +CONFIGURE_FILE=@@PKG_SYSCONFDIR@@/configure # It is possible to specify a colon-separated list of files for CONFIGURE_FILE. # In this case, Exim will use the first of them that exists when it is run. @@@@ -133,7 +133,7 @@@@ CONFIGURE_FILE=/usr/exim/configure # deliveries. (Local deliveries run as various non-root users, typically as the # owner of a local mailbox.) Specifying these values as root is not supported. -EXIM_USER= +EXIM_USER=ref:@@EXIM_USER@@ # If you specify EXIM_USER as a name, this is looked up at build time, and the # uid number is built into the binary. However, you can specify that this @@@@ -154,7 +154,7 @@@@ EXIM_USER= # for EXIM_USER (e.g. EXIM_USER=exim), you don't need to set EXIM_GROUP unless # you want to use a group other than the default group for the given user. -# EXIM_GROUP= +EXIM_GROUP=ref:@@EXIM_GROUP@@ # Many sites define a user called "exim", with an appropriate default group, # and use @@@@ -175,7 +175,7 @@@@ EXIM_USER= # Almost all installations choose this: -SPOOL_DIRECTORY=/var/spool/exim +SPOOL_DIRECTORY=@@VARBASE@@/spool/exim @@@@ -752,7 +752,7 @@@@ FIXED_NEVER_USERS=root # included in the Exim binary. You will then need to set up the run time # configuration to make use of the mechanism(s) selected. -# AUTH_CRAM_MD5=yes +AUTH_CRAM_MD5=yes # AUTH_CYRUS_SASL=yes # AUTH_DOVECOT=yes # AUTH_EXTERNAL=yes @@@@ -761,8 +761,8 @@@@ FIXED_NEVER_USERS=root # AUTH_HEIMDAL_GSSAPI=yes # AUTH_HEIMDAL_GSSAPI_PC=heimdal-gssapi # AUTH_HEIMDAL_GSSAPI_PC=heimdal-gssapi heimdal-krb5 -# AUTH_PLAINTEXT=yes -# AUTH_SPA=yes +AUTH_PLAINTEXT=yes +AUTH_SPA=yes # AUTH_TLS=yes # Heimdal through 1.5 required pkg-config 'heimdal-gssapi'; Heimdal 7.1 @@@@ -896,7 +896,7 @@@@ HEADERS_CHARSET="ISO-8859-1" # %s. This will be replaced by one of the strings "main", "panic", or "reject" # to form the final file names. Some installations may want something like this: -# LOG_FILE_PATH=/var/log/exim_%slog +LOG_FILE_PATH=@@VARBASE@@/log/exim/%s # which results in files with names /var/log/exim_mainlog, etc. The directory # in which the log files are placed must exist; Exim does not try to create @@@@ -1201,13 +1201,13 @@@@ SYSTEM_ALIASES_FILE=/etc/aliases # haven't got Perl, Exim will still build and run; you just won't be able to # use those utilities. -# CHOWN_COMMAND=/usr/bin/chown -# CHGRP_COMMAND=/usr/bin/chgrp -# CHMOD_COMMAND=/usr/bin/chmod -# MV_COMMAND=/bin/mv -# RM_COMMAND=/bin/rm -# TOUCH_COMMAND=/usr/bin/touch -# PERL_COMMAND=/usr/bin/perl +CHOWN_COMMAND=@@CHOWN@@ +CHGRP_COMMAND=@@CHGRP@@ +CHMOD_COMMAND=@@CHMOD@@ +MV_COMMAND=@@MV@@ +RM_COMMAND=@@RM@@ +TOUCH_COMMAND=@@TOUCH@@ +PERL_COMMAND=@@PERL5@@ #------------------------------------------------------------------------------ @@@@ -1409,7 +1409,7 @@@@ EXIM_TMPDIR="/tmp" # (process id) to a file so that it can easily be identified. The path of the # file can be specified here. Some installations may want something like this: -# PID_FILE_PATH=/var/lock/exim.pid +PID_FILE_PATH=/var/run/exim.pid # If PID_FILE_PATH is not defined, Exim writes a file in its spool directory # using the name "exim-daemon.pid". @@@@ -1465,6 +1465,13 @@@@ EXIM_TMPDIR="/tmp" # EXPAND_LISTMATCH_RHS=yes +EXTRALIBS_EXIM=-liconv + +@@EXIM_USE_DB_CONFIG@@ +@@EXIM_DBMLIB@@ +INCLUDE=@@EXIM_INCLUDE@@ +LOOKUP_LIBS=@@LOOKUP_LIBS@@ + #------------------------------------------------------------------------------ # Disabling the use of fsync(): DO NOT UNCOMMENT THE FOLLOWING LINE unless you # really, really, really know what you are doing. And even then, think again. @ 1.1 log @Version 4.89 ------------ 1. Allow relative config file names for ".include" 2. A main-section config option "debug_store" to control the checks on variable locations during store-reset. Normally false but can be enabled when a memory corrution issue is suspected on a production system. @ text @d1 1 a1 1 $NetBSD: patch-aa,v 1.24 2016/01/10 20:55:56 bsiegert Exp $ d3 1 a3 1 --- Local/Makefile.pkgsrc.orig 2017-03-18 06:47:43.000000000 +0000 d5 1 a5 1 @@@@ -98,7 +98,7 @@@@ d14 1 a14 1 @@@@ -114,7 +114,7 @@@@ BIN_DIRECTORY=/usr/exim/bin d23 1 a23 1 @@@@ -131,7 +131,7 @@@@ CONFIGURE_FILE=/usr/exim/configure d32 1 a32 1 @@@@ -152,7 +152,7 @@@@ EXIM_USER= d41 1 a41 1 @@@@ -173,7 +173,7 @@@@ EXIM_USER= d50 1 a50 10 @@@@ -380,7 +380,7 @@@@ PCRE_CONFIG=yes # files are defaulted in the OS/Makefile-Default file, but can be overridden in # local OS-specific make files. -EXIM_MONITOR=eximon.bin +# EXIM_MONITOR=eximon.bin #------------------------------------------------------------------------------ @@@@ -622,7 +622,7 @@@@ FIXED_NEVER_USERS=root d58 2 a59 2 # AUTH_GSASL=yes @@@@ -630,8 +630,8 @@@@ FIXED_NEVER_USERS=root d70 1 a70 1 @@@@ -831,7 +831,7 @@@@ HEADERS_CHARSET="ISO-8859-1" d79 1 a79 1 @@@@ -1119,13 +1119,13 @@@@ SYSTEM_ALIASES_FILE=/etc/aliases d100 1 a100 1 @@@@ -1327,7 +1327,7 @@@@ EXIM_TMPDIR="/tmp" d109 3 a111 2 @@@@ -1399,3 +1399,10 @@@@ EXIM_TMPDIR="/tmp" # ENABLE_DISABLE_FSYNC=yes a112 2 # End of EDITME for Exim 4. + d119 4 @