This release of Exim includes one incompatible fix:
+ the behavior of expansion of arguments to math comparison functions
(<, <=, =, =>, >) was unexpected, expanding the values twice;
CVE-2014-2972; (bnc#888520)
This release contains the following enhancements and bugfixes:
+ PRDR was promoted from Experimental to mainline
+ OCSP Stapling was promoted from Experimental to mainline
+ new Experimental feature Proxy Protocol
+ new Experimental feature DSN (Delivery Status Notifications)
+ TLS session improvements
+ TLS SNI fixes
+ LDAP enhancements
+ DMARC fixes (previous CVE-2014-2957) and new $dmarc_domain_policy
+ several new operations (listextract, utf8clean, md5, sha1)
+ enforce header formatting with verify=header_names_ascii
+ new commandline option -oMm
+ new TLSA dns lookup
+ new malware "sock" type
+ cutthrough routing enhancements
+ logging enhancements
+ DNSSEC enhancements
+ exiqgrep enhancements
+ deprecating non-standard SPF results
+ build and portability fixes
+ documentation fixes and enhancements
- Verify source tar ball gpg signature.
- Refresh exim-enable_ecdh_openssl.patch and strip version number from the
patch filename.
OBS-URL: https://build.opensuse.org/package/show/server:mail/exim?expand=0&rev=140
- Bugzilla 949 - Documentation tweak.
- Bugzilla 1093 - eximstats DATA reject detection regexps improved.
- Bugzilla 1169 - primary_hostname spelling was incorrect in docs.
- Implemented gsasl authenticator.
- Implemented heimdal_gssapi authenticator with "server_keytab" option.
- Local/Makefile support for (AUTH|LOOKUP)_*_PC=foo to use
`pkg-config foo` for cflags/libs.
- Swapped $auth1/$auth2 for gsasl GSSAPI mechanism, to be more consistent
with rest of GSASL and with heimdal_gssapi.
- Local/Makefile support for USE_(GNUTLS|OPENSSL)_PC=foo to use
`pkg-config foo` for cflags/libs for the TLS implementation.
- New expansion variable $tls_bits; Cyrus SASL server connection
properties get this fed in as external SSF. A number of robustness
and debugging improvements to the cyrus_sasl authenticator.
- cyrus_sasl server now expands the server_realm option.
- Bugzilla 1214 - Log authentication information in reject log.
- Added dbmjz lookup type.
- Let heimdal_gssapi authenticator take a SASL message without an authzid.
- MAIL args handles TAB as well as SP, for better interop with
non-compliant senders.
- Bugzilla 1237 - fix cases where printf format usage not indicated.
- tls_peerdn now print-escaped for spool files.
Observed some $tls_peerdn in wild which contained \n, which resulted
in spool file corruption.
- TLS fixes for OpenSSL: support TLS 1.1 & 1.2; new "openssl_options"
values; set SSL_MODE_AUTO_RETRY so that OpenSSL will retry a read
or write after TLS renegotiation, which otherwise led to messages
"Got SSL error 2".
- Bugzilla 1239 - fix DKIM verification when signature was not inserted
as a tracking header (ie: a signed header comes before the signature).
- Bugzilla 660 - Multi-valued attributes from ldap now parseable as a
comma-sep list; embedded commas doubled.
- Refactored ACL "verify =" logic to table-driven dispatch.
- LDAP: Check for errors of TLS initialisation, to give correct diagnostics.
- Removed "dont_insert_empty_fragments" fron "openssl_options".
Removed SSL_clear() after SSL_new() which led to protocol negotiation
failures. We appear to now support TLS1.1+ with Exim.
- OpenSSL: new expansion var $tls_sni, which if used in tls_certificate
lets Exim select keys and certificates based upon TLS SNI from client.
Also option tls_sni on SMTP Transports. Also clear $tls_bits correctly
before an outbound SMTP session. New log_selector, +tls_sni.
- Bugzilla 1122 - check localhost_number expansion for failure, avoid
NULL dereference.
- Revert part of NM/04, it broke log_path containing %D expansions.
Left warnings. Added "eximon gdb" invocation mode.
- Defaulting "accept_8bitmime" to true, not false.
- Added -bw for inetd wait mode support.
- Added PCRE_CONFIG=yes support to Makefile for using pcre-config to
locate the relevant includes and libraries. Made this the default.
- Fixed headers_only on smtp transports (was not sending trailing dot).
Bugzilla 1246, report and most of solution from Tomasz Kusy.
- ${eval } now uses 64-bit and supports a "g" suffix (like to "k" and "m").
This may cause build issues on older platforms.
- Revamped GnuTLS support, passing tls_require_ciphers to
gnutls_priority_init, ignoring Exim options gnutls_require_kx,
gnutls_require_mac & gnutls_require_protocols (no longer supported).
Added SNI support via GnuTLS too.
Made ${randint:..} supplier available, if using not-too-old GnuTLS.
- Added EXPERIMENTAL_OCSP for OpenSSL.
- Applied dnsdb SPF support patch from Janne Snabb.
Applied second patch from Janne, implementing suggestion to default
multiple-strings-in-record handling to match SPF spec.
- Added expansion variable $tod_epoch_l for a higher-precision time.
- Fix DCC dcc_header content corruption (stack memory referenced,
read-only, out of scope).
Patch from Wolfgang Breyha, report from Stuart Northfield.
- Fix three issues highlighted by clang analyser static analysis.
Only crash-plausible issue would require the Cambridge-specific
iplookup router and a misconfiguration.
Report from Marcin Mirosław.
- Another attempt to deal with PCRE_PRERELEASE, this one less buggy.
- %D in printf continues to cause issues (-Wformat=security), so for
now guard some of the printf checks behind WANT_DEEPER_PRINTF_CHECKS.
As part of this, removing so much warning spew let me fix some minor
real issues in debug logging.
- GnuTLS was always using default tls_require_ciphers, due to a missing
assignment on my part. Fixed.
- Added tls_dh_max_bits option, defaulting to current hard-coded limit
of NSS, for GnuTLS/NSS interop.
- Validate tls_require_ciphers on startup, since debugging an invalid
string otherwise requires a connection and a bunch more work and it's
relatively easy to get wrong. Should also expose TLS library linkage
problems.
- Pull in <features.h> on Linux, for some portability edge-cases of
64-bit ${eval} (JH/03).
- Define _GNU_SOURCE in exim.h; it's needed for some releases of
protection layer was required, which is not implemented. Bugzilla 1254
- Overhaul DH prime handling, supply RFC-specified DH primes as built
into Exim, default to IKE id 23 from RFC 5114 (2048 bit). Make
tls_dhparam take prime identifiers. Also unbreak combination of
OpenSSL+DH_params+TLSSNI.
- Disable SSLv2 by default in OpenSSL support.
OBS-URL: https://build.opensuse.org/package/show/server:mail/exim?expand=0&rev=122
- Workround for PCRE version dependency in version reporting
Bugzilla 1073
- Permit LOOKUP_foo enabling on the make command-line.
Also via indented variable definition in the Makefile.
- Restore caching of spamd results with expanded spamd_address.
- Build issue: lookups-Makefile now exports LC_ALL=C
Improves build reliability.
- Fix wide character breakage in the rfc2047 coding; Fixes bug 1064.
- Allow underscore in dnslist lookups; Fixes bug 1026.
- Bugzilla 230: Support TLS-enabled LDAP (in addition to ldaps).
- Fixed exiqgrep to cope with mailq missing size issue
Fixes bug 943.
- Bugzilla 1083: when lookup expansion defers, escape the output which
is logged, to avoid truncation.
- Bugzilla 1042: implement freeze_signal on pipe transports.
- Bugzilla 1061: restrict error messages sent over SMTP to not reveal
SQL string expansion failure details.
- Bugzilla 486: implement %M datestamping in log filenames.
- New lookups functionality failed to compile on old gcc which rejects
extern declarations in function scope.
- Use sig_atomic_t for flags set from signal handlers.
Check getgroups() return and improve debugging.
Fixed developed for diagnosis in bug 927 (which turned out to be
a kernel bug).
- Bugzilla 1055: Update $message_linecount for maildir_tag.
- Bugzilla 1056: Improved spamd server selection.
- Bugzilla 1086: Deal with maildir quota file races.
- Bugzilla 1019: DKIM multiple signature generation fix.
OBS-URL: https://build.opensuse.org/package/show/server:mail/exim?expand=0&rev=106
- Failure to get a lock on a hints database can have serious
consequences so log it to the panic log.
- Log LMTP confirmation messages in the same way as SMTP,
controlled using the smtp_confirmation log selector.
- Include the error message when we fail to unlink a spool file.
- Bugzilla 139: Support dynamically loaded lookups as modules.
- Bugzilla 139: Documentation and portability issues.
Avoid GNU Makefile-isms, let Exim continue to build on BSD.
Handle per-OS dynamic-module compilation flags.
- Let /dev/null have normal permissions.
The 4.73 fixes were a little too stringent and complained about the
permissions on /dev/null. Exempt it from some checks.
- Report version information for many libraries, including
Exim version information for dynamically loaded libraries. Created
version.h, now support a version extension string for distributors
who patch heavily. Dynamic module ABI change.
- CVE-2011-0017 - check return value of setuid/setgid. This is a
privilege escalation vulnerability whereby the Exim run-time user
can cause root to append content of the attacker's choosing to
arbitrary files.
- Bugzilla 1041: merged DCC maintainer's fixes for return code.
- Bugzilla 1071: fix delivery logging with untrusted macros.
If dropping privileges for untrusted macros, we disabled normal logging
on the basis that it would fail; for the Exim run-time user, this is not
the case, and it resulted in successful deliveries going unlogged.
- update to 4.73
- Date: & Message-Id: revert to normally being appended to a message,
only prepend for the Resent-* case. Fixes regression introduced in
Exim 4.70 by NM/22 for Bugzilla 607.
- Include check_rfc2047_length in configure.default because we're seeing
increasing numbers of administrators be bitten by this.
- Added DISABLE_DKIM and comment to src/EDITME
- Bugzilla 994: added openssl_options main configuration option.
- Bugzilla 995: provide better SSL diagnostics on failed reads.
- Bugzilla 834: provide a permit_coredump option for pipe transports.
- Adjust NTLM authentication to handle SASL Initial Response.
- If TLS negotiated an anonymous cipher, we could end up with SSL but
without a peer certificate, leading to a segfault because of an
assumption that peers always have certificates. Be a little more
paranoid. Problem reported by Martin Tscholak.
- Bugzilla 926: switch ClamAV to use the new zINSTREAM API for content
filtering; old API available if built with WITH_OLD_CLAMAV_STREAM=yes
NB: ClamAV planning to remove STREAM in "middle of 2010".
CL also introduces -bmalware, various -d+acl logging additions and
more caution in buffer sizes.
- Implemented reverse_ip expansion operator.
- Bugzilla 937: provide a "debug" ACL control.
- Bugzilla 922: Documentation dusting, patch provided by John Horne.
- Bugzilla 973: Implement --version.
- Bugzilla 752: Refuse to build/run if Exim user is root/0.
- Build without WITH_CONTENT_SCAN. Path from Andreas Metzler.
- Bugzilla 816: support multiple condition rules on Routers.
- Add bool_lax{} expansion operator and use that for combining multiple
condition rules, instead of bool{}. Make both bool{} and bool_lax{}
ignore trailing whitespace.
- prevent non-panic DKIM error from being sent to paniclog
- added tcp_wrappers_daemon_name to allow host entries other than
"exim" to be used
- Fix malware regression for cmdline scanner introduced in PP/08.
Notification from Dr Andrew Aitchison.
- Change ClamAV response parsing to be more robust and to handle ClamAV's
ExtendedDetectionInfo response format.
Notification from John Horne.
- OpenSSL 1.0.0a compatibility const-ness change, should be backwards
compatible.
- Added a CONTRIBUTING file. Fixed the documentation build to use http:
XSL and documented dependency on system catalogs, with examples of how
it normally works.
- Added Valgrind hooks in store.c to help it capture out-of-bounds store
access.
- Bugzilla 1044: CVE-2010-4345 - partial fix: restrict default behaviour
of CONFIGURE_OWNER and CONFIGURE_GROUP options to no longer allow a
configuration file which is writeable by the Exim user or group.
- Bugzilla 1044: CVE-2010-4345 - part two: extend checks for writeability
of configuration files to cover files specified with the -C option if
they are going to be used with root privileges, not just the default
configuration file.
- Bugzilla 1044: CVE-2010-4345 - part three: remove ALT_CONFIG_ROOT_ONLY
option (effectively making it always true).
- Add TRUSTED_CONFIG_PREFIX_FILE option to allow alternative configuration
files to be used while preserving root privileges.
- Set FD_CLOEXEC on SMTP sockets after forking in the daemon, to ensure
that rogue child processes cannot use them.
- Bugzilla 1047: change the default for system_filter_user to be the Exim
run-time user, instead of root.
- Add WHITELIST_D_MACROS option to let some macros be overriden by the
Exim run-time user without dropping privileges.
- Remove use of va_copy() which breaks pre-C99 systems. Duplicate the
result string, instead of calling string_vformat() twice with the same
arguments.
- Allow TRUSTED_CONFIG_PREFIX_FILE only for Exim or CONFIGURE_OWNER, not
for other users. Others should always drop root privileges if they use
-C on the command line, even for a whitelisted configure file.
- Turn TRUSTED_CONFIG_PREFIX_FILE into TRUSTED_CONFIG_FILE. No prefixes.
- Fixed bug #1002 - Message loss when using multiple deliveries
OBS-URL: https://build.opensuse.org/package/show/server:mail/exim?expand=0&rev=98
