-
Notifications
You must be signed in to change notification settings - Fork 179
/
Copy pathChangeLog
8790 lines (6487 loc) · 411 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
This document describes *changes* to previous versions, that might
affect Exim's operation, with an unchanged configuration file. For new
options, and new features, see the NewStuff file next to this ChangeLog.
Exim version 4.98
-----------------
JH/01 Use fewer forks & execs for sending many messages to a single host.
By passing back more info from the transport to the delivery process,
we can loop there. A two-phase queue run will benefit, particularly for
mailinglist and smarthost cases.
JH/02 Add transaction support for hintsdbs. The providers supported are tdb and
sqlite. Transactions are used for the wait-transport and retry DBs.
They imply locking internal to the DB. We no longer need a separate
lockfile, can keep the DB handle open for extended periods, yet
potentially benefit from concurrency on non-conflicting record uses.
JH/03 With dkim_verify_minimal, avoid calling the DKIM ACL after the first
good verify.
JH/04 Remove the docs and support scripts dealing with conversion of Exim
version 3 installations.
JH/05 Fix hintsdb support for dbmjz when compiled using sqlite3. Previously
the backend support assumed keys would be simple C strings, but dbmjz
uses keys with embedded NUL bytes. The builtin hintsdb use is unaffected,
but installations using dbmjz will need to rebuild those DBs.
JH/06 Bug 1141: When operating a continued-connection transport, verify that
the interface option, if specified, evaluates to match the connection.
Previously, a queued message for the same host was sent without checking.
JH/07 Bug 3106: Fix coding in SPA authenticator. A macro argument was not
properly parenthesized, resulting in a logic error. While the simple
fix was provided by Andrew Aitchison, the over-large code block resulting
from this macro made me want to replace it with a real function so more
extensive rework becamse needed.
JH/08 The output of "exim -bV" now includes lookup types built as dynamic-load
modules.
JH/09 Not a change, but worthy of note: There is no test coverage of the
heimdall-gssapi authenticator driver. It does build, though with (on at
least one platform) library version conflicts with the gsasl auth
driver). Confidence in its operation is lacking.
JH/10 Bug 3108: On platforms not providing strchrnul() [OpenBSD] supply a proper
prototype (as well as implementaton). Previously, a return type "int"
was assumed, resulting in type-conversion bugs when int and pointer had
different size. This resulted in crashes while processing DKIM signatures
of received messages. Identification and fix from Qualys Security.
JH/11 Lookups built as dynamic-load modules which support a single lookup
type are now only loaded if required by the config. Previously all lookup
modules present in the modules directory were loaded; this now applies
only to those supporting multiple types.
JH/12 Bug 3112: Fix logging of config-file position for "obsolete lookup
syntax". Previously, the end of the top-level file was reported.
JH/13 Bug 3120: Fix parsing of DKIM pubkey DNS record. Previously a crafted
record could crash the meesage recieve process. Investigation by
Maxim Galaganov.
JH/14 Bug 3116: Fix crash in dkim signing. On kernels supporting immutable
memory segments, a write was done into one when a constant string was
configured for a transport's dkim private key.
JH/15 Disallow tainted metadata in lists.
- Change-of-separator prefixes are handled specially when they are
explicit text; only the remainder of the list is expanded. A change-of-
separator resulting from expansion will not take effect if tainted.
- Elements starting with a plus-sign (named-list inclusion,
case-interpretation etc) and (hostlist) @[] (et al) are not handled
specially and are still operative at this time - but warnings are logged;
if any of these are needed in a list with a tainted element (which taints
the entire list at string-expansion time) then a named-list can be used
for that element.
- Exclamation-marks ("!" signifying negation) are not checked for taint
at this time.
JH/16 Bug 3124: Fix theoretical crash in received connection, triggerable by a
crafted packet with massive count of IP options. A buffer overflow was
detected, but a null-deref results. In practice, IP packets with options
are rare (to non-existent). Exim refuses connections having any, but this
issue was in the coding for logging preceding that refusal. If coredumps
were enabled (not common), an attack could cause filesystem space usage.
JH/17 Bug 3126: Fix build error in the ibase lookup. Find & fix by
Andrew Aitchison.
JH/18 Bug 3102: The dmarc_tld_file and dmarc_history_file options are now
expanded before use.
JH/19 Bug 3092: Call acl_smtp_notquit for drops associated with the
smtp_max_synprot_errors limit.
JH/20 Bug 3036: Fix smuggling attack on DKIM verification. A crafted insertion
between message header and body could look like a header, unsigned, for
the verification code but as part of the body for delivery of the message.
Address by cancelling verification.
JH/21 Bug 2995: For dsearch lookups, remove the requirement for read permission
on the directory. Only search permission is now needed.
JH/22 Fix OpenSSL client tls_verify_certificates vs. tls_verify_hosts behaviour
for the case where _hosts is set-but-empty. A previous fix, for 4.95,
missed this case.
JH/23 Fix continued-connection. When a transport identified a further message
due for the connection, tls was being used, tls-proxying configured (the
default), and an interface specified (not default but not uncommon) a
null-pointer indirection could result, crashing the transport process.
Although no mails would be lost this would pollute logs and potentially
take up filesystem space. Observed on OpenSBD but possibly platform
dependent; present since 4.90.
JH/24 Under Linux, more reliable detection of client TCP Fast Open with-data
case, for logging.
JH/25 Fix logging of client-side TFO on tls-on-connect connections. Previously
this use was not noted.
JH/26 Logging of client certificate verification status is no longer done when
no certificate was presented (which is the common case). Previously this
was recorded as "CV=no"; that item and value is now only used for a
failed verify of a presented certificate.
JH/27 OpenSSL: remove version 0.9.x library support. Version 1.0.0 was tagged
in 2010; it's time we cleaned up the Exim ifdeffery. As part of this we
assume that various OpenSSL features are included in its build - TLS
extensions, sha256, ecdh, ocsp; builds could fail due to missing APIs
on trying to link with cut-down libraries.
Exim version 4.98
-----------------
JH/01 Support list of dkim results in the dkim_status ACL condition, making
it more usable in the data ACL.
JH/02 Bug 3040: Handle error on close of the spool data file during reception.
Previously This was only logged, on the assumption that errors would be
seen for a previous fflush(). However, a fuse filesystem has been
reported as showing this an error for the fclose(). The spool is now in
an uncertain state, and we have logged and responded acceptance. Change
this to respond with a temp-reject, wipe spoolfiles, and log the error
detail.
JH/03 Bug 3030: Fix handling of DNS servfail respons for DANE TLSA. When hit
during a recipient verify callout, a QUIT command was attempted on the
now-closed callout channel, causing a paniclog entry.
JH/04 Bug 3039: Fix handling of of an empty log_reject_target, with
a connection_reject log_selector, under tls_on_connect. Previously
with this combination, when the connect ACL rejected, a spurious
paniclog entry was made.
JH/05 Fix TLS resumption for TLS-on-connect. This was broken by the advent
of loadbalancer-detection for resumption, in 4.96 - which tries to
use the EHLO response. SMTPS does not have one at the time it is starting
TLS. Change the default for the smtp transport host_name_extract option
to be a static string, for TLS-on-connect cases; meaning that resumption
will always be attempted (unless deliberately overriden).
JH/06 Bug 3054: Fix dnsdb lookup for a TXT record with multiple chunks, with a
chunk-separator specification. This was broken by hardening introduced
for Bug 3031.
JH/07 Bug 3050: Fix -bp for old message_id format spoolfiles. Previously it
included the -H with the id; this also messed up exiqgrep.
JH/08 Bug 3056: Tighten up parsing of DKIM DNS records. Previously, whitespace
was not properly skipped and empty elements would cause mis-parsing.
Tighten parsing of DKIM header records. Previously, all but lowercase
alpha chars would be ignored in potential tag names.
JH/09 Bug 3057: Add heuristic for spotting mistyped IPv6 addresses in lists
being searched. Previously we only had one for IPv4 addresses. Per the
documentation, the error results by default in a no-match result for the
list. It is logged if the unknown_in_list log_selector is used.
JH/10 Bug 3058: Ensure that a failing expansion in a router "set" option defers
the routing operation. Previously it would silently stop routing the
message.
JH/11 Bug 3046: Fix queue-runs. Previously, the arrivel of a notification or
info-request event close in time to a scheduled run timer could result in
the latter being missed, and no further queue scheduled runs being
initiated. This ouwld be more likely on high-load systems.
JH/12 Refuse to accept a line "dot, LF" as end-of-DATA unless operating in
LF-only mode (as detected from the first header line). Previously we did
accept that in (normal) CRLF mode; this has been raised as a possible
attack scenario (under the name "smtp smuggling").
JH/13 Add an fdatasync call for the received message data file in spool, before
loggging reception and sending the SMTP ack. Previously we only flushed
the stdio buffer so there was still the possibility of a disk error.
JH/14 Bug 3061: Avoid a split log line when trying to rewrite a malformed
address. Previously, for the last address in a header line (commonly
there is only one) the terminating newline was part of the logged
information.
JH/15 Bug 3061: Ensure a log line is written for a malformed address in a
header, when parsing for address-qualification. Previously one was only
written if there were rewrite rules.
JH/16 Two-phase queue runs are now reported in the daemon startup log line and
in exiwhat output.
JH/17 Bug 3064: Fix combination of "-q<period> -R <recipients>". Introduction of
the multiple-queue-runners facility for 4.97 broke this, giving only a
one-time run of the queue.
JH/18 Bug 3068: Log a warning for use of deprecated syntax in query-style
lookups.
JH/19 Fix TLS startup. When the last expansion done before the initiation of a
TLS session resulted in a forced-fail, a misleading error was logged for
the expansino of tls_certificates. This would affect the common case of
that option being set (main-section options) but not having any variable
parts. It could also potentially affect tls_privatekeys. The underlyding
coding errors go back to 4.90 but were only exposed in 4.97.
JH/20 Bug 3047: A recent (somewhere between 10.34 and 10.42) version of the
pcre2 library starting allocating 20kB rather than 112 bytes per match
call, which broke the 2GB total limitation on Exim's memory management
when a user had over 104207 messages stored and the appendfile
maildir_quota_directory_regex option is in use. Release the allocated
memory every thosand files to avoid this.
The same issue arises with the ACL regex condition, which is applied
to every line of a received message.
JH/21 Bug 3059: Fix crash in smtp transport. When running for a message for
which all recipients had been handled (itself an issue) a null-pointer
deref was done on trying to write a retry record. Fix that by counting
the outstanding recipients before trying to transmit the message.
The situation arose for a second MX try within a transport run, when the
first had perm-rejected a recipient (the only one for the connection, in
the case seen) during pipelining, and then closed the TCP connection.
The transport classified that as an I/O error, leaving the message
outstanding but having marked up the recipient as dealt-with. It then
tried another MX because of the I/O error. Fix this by converting the
message-level status to ok if there was a close but all recipients were
dealt with. Thanks to Wolfgand Breyha for debug runs.
JH/22 The ESMTP_LIMITS facility (RFC 9422) is promoted from experimental status
and is now controlled by the build-time option DISABLE_ESMTP_LIMITS.
JH/23 Bug 3066: Avoid leaking lookup database credentials to log.
JH/24 Bug 3081: Fix a delivery process crash. When the router "errors_to"
option specified a fixed address, later rewriting on that address would
trip on the configuration data being readonly. Instead of modifying
in-place, copy data. Found and fixed by Peter Benie.
JH/25 Bug 3079: Fix crash in dbmnz. When a key was present for zero-length
data a null pointer was followed. Find and testcase by Sebastian Bugge.
JH/26 Fix encoding for an AUTH parameter on a MAIL FROM command. Previously
decimal 127 chars were not encoded, and lowercase hex was used for
encoded values. Outstanding since at least 1999.
JH/27 Fix crash in logging. When a message with a large number of recipients
had been received, and logging of recipients is enabled, the buffer used
for logging could reach limit. A read using a null pointer would then
be done, resulting in a crash of the receiving process before an SMTP
ACK for the message was returned to the sending system. Duplicate
messages were created as a result.
Find and debug help by Mateusz Krawczyk
JH/28 Bug 3086: Fix exinext for ipv6. Change the format of keys in the retry
DB, wrapping transport record bare-ip "host names" and ipv6
"host addresses" in square-brackets. This makes the parsing that
exinext does more reliable.
JH/29 Bug 3087: Fix SRS encode. A zero-length quoted element in the local-part
would cause a crash.
JH/30 Bug 3029: Avoid feeding Resent-From: to DMARC.
JH/31 Bug 3027: For -bh / -bhc tests change to using the compressed form of
ipv6 addresses for the sender. Previously the uncompressed form was used,
and if used in textual form this would result in behavior difference
versus non-bh.
JH/32 Bug 3096: MAIL before HELO/EHLO, where required by hosts_require_helo, is
now classed as a protocol error and subject to smtp_max_synprot_errors.
JH/33 Bug 2994: A subdir dsearch lookup should permit a directory name that starts
".." and has following characters.
JH/34 Fix delivery ordering for 2-phase queue run combined with
queue_run_in_order.
JH/35 Bug 3099: fix parsing of MIME filename= split over multiple paramemters.
Previously the $mime_filename variable would have an incorrect value.
While in the code, extend coverage to name= which previously was only
supported for single parameters, despite also filling in $mime_filename.
Exim version 4.97
-----------------
JH/01 The hosts_connection_nolog main option now also controls "no MAIL in
SMTP connection" log lines.
JH/02 Option default value updates:
- queue_fast_ramp (main) true (was false)
- remote_max_parallel (main) 4 (was 2)
JH/03 Cache static regex pattern compilations, for use by ACLs.
JH/04 Bug 2903: avoid exit on an attempt to rewrite a malformed address.
Make the rewrite never match and keep the logging. Trust the
admin to be using verify=header-syntax (to actually reject the message).
JH/05 Follow symlinks for placing a watch on TLS creds files. This means
(under Linux) we watch the dir containing the final file; previously
it would be the dir with the first symlink. We still do not monitor
the entire path.
JH/06 Check for bad chars in rDNS for sender_host_name. The OpenBSD (at least)
dn_expand() is happy to pass them through.
JH/07 OpenSSL Fix auto-reload of changed server OCSP proof. Previously, if
the file with the proof had an unchanged name, the new proof(s) were
loaded on top of the old ones (and nover used; the old ones were stapled).
JH/08 Bug 2915: Fix use-after-free for $regex<n> variables. Previously when
more than one message arrived in a single connection a reference from
the earlier message could be re-used. Often a sigsegv resulted.
These variables were introduced in Exim 4.87.
Debug help from Graeme Fowler.
JH/09 Fix ${filter } for conditions that modify $value. Previously the
modified version would be used in construction the result, and a memory
error would occur.
JH/10 GnuTLS: fix for (IOT?) clients offering no TLS extensions at all.
Find and fix by Jasen Betts.
JH/11 OpenSSL: fix for ancient clients needing TLS support for versions earlier
than TLSv1,2, Previously, more-recent versions of OpenSSL were permitting
the systemwide configuration to override the Exim config.
HS/01 Bug 2728: Introduce EDITME option "DMARC_API" to work around incompatible
API changes in libopendmarc.
JH/12 Bug 2930: Fix daemon startup. When started from any process apart from
pid 1, in the normal "background daemon" mode, having to drop process-
group leadership also lost track of needing to create listener sockets.
JH/13 Bug 2929: Fix using $recipients after ${run...}. A change made for 4.96
resulted in the variable appearing empty. Find and fix by Ruben Jenster.
JH/14 Bug 2933: Fix regex substring match variables for null matches. Since 4.96
a capture group which obtained no text (eg. "(abc)*" matching zero
occurrences) could cause a segfault if the corresponding $<n> was
expanded.
JH/15 Fix argument parsing for ${run } expansion. Previously, when an argument
included a close-brace character (eg. it itself used an expansion) an
error occurred.
JH/16 Move running the smtp connect ACL to before, for TLS-on-connect ports,
starting TLS. Previously it was after, meaning that attackers on such
ports had to be screened using the host_reject_connection main config
option. The new sequence aligns better with the STARTTLS behaviour, and
permits defences against crypto-processing load attacks, even though it
is strictly an incompatible change.
Also, avoid sending any SMTP fail response for either the connect ACL
or host_reject_connection, for TLS-on-connect ports.
JH/17 Permit the ACL "encrypted" condition to be used in a HELO/EHLO ACL,
Previously this was not permitted, but it makes reasonable sense.
While there, restore a restriction on using it from a connect ACL; given
the change JH/16 it could only return false (and before 4.91 was not
permitted).
JH/18 Fix a fencepost error in logging. Previously (since 4.92) when a log line
was exactly sized compared to the log buffer, a crash occurred with the
misleading message "bad memory reference; pool not found".
Found and traced by Jasen Betts.
JH/19 Bug 2911: Fix a recursion in DNS lookups. Previously, if the main option
dns_again_means_nonexist included an element causing a DNS lookup which
itself returned DNS_AGAIN, unbounded recursion occurred. Possible results
included (though probably not limited to) a process crash from stack
memory limit, or from excessive open files. Replace this with a paniclog
whine (as this is likely a configuration error), and returning
DNS_NOMATCH.
JH/20 Bug 2954: (OpenSSL) Fix setting of explicit EC curve/group. Previously
this always failed, probably leading to the usual downgrade to in-clear
connections.
JH/21 Fix TLSA lookups. Previously dns_again_means_nonexist would affect
SERVFAIL results, which breaks the downgrade resistance of DANE. Change
to not checking that list for these lookups.
JH/22 Bug 2434: Add connection-elapsed "D=" element to more connection
closure log lines.
JH/23 Fix crash in string expansions. Previously, if an empty variable was
immediately followed by an expansion operator, a null-indirection read
was done, killing the process.
JH/24 Bug 2997: When built with EXPERIMENTAL_DSN_INFO, bounce messages can
include an SMTP response string which is longer than that supported
by the delivering transport. Alleviate by wrapping such lines before
column 80.
JH/25 Bug 2827: Restrict size of References: header in bounce messages to 998
chars (RFC limit). Previously a limit of 12 items was made, which with
a not-impossible References: in the message being bounced could still
be over-large and get stopped in the transport.
JH/26 For a ${readsocket } in TLS mode, send a TLS Close Alert before the TCP
close. Previously a bare socket close was done.
JH/27 Fix ${srs_encode ..}. Previously it would give a bad result for one day
every 1024 days.
JH/28 Bug 2996: Fix a crash in the smtp transport. When finding that the
message being considered for delivery was already being handled by
another process, and having an SMTP connection already open, the function
to close it tried to use an uninitialized variable. This would afftect
high-volume sites more, especially when running mailing-list-style loads.
Pollution of logs was the major effect, as the other process delivered
the message. Found and partly investigated by Graeme Fowler.
JH/29 Change format of the internal ID used for message identification. The old
version only supported 31 bits for a PID element; the new 64 (on systems
which can use Base-62 encoding, which is all currently supported ones
but not Darwin (MacOS) or Cygwin, which have case-insensitive filesystems
and must use Base-36). The new ID is 23 characters rather than 16, and is
visible in various places - notably logs, message headers, and spool file
names. Various of the ancillary utilities also have to know the format.
As well as the expanded PID portion, the sub-second part of the time
recorded in the ID is expanded to support finer precision. Theoretically
this permits a receive rate from a single comms channel of better than the
previous 2000/sec.
The major timestamp part of the ID is not changed; at 6 characters it is
usable until about year 3700.
Updating from previously releases is fully supported: old-format spool
files are still usable, and the utilities support both formats. New
message will use the new format. The one hints-DB file type which uses
message-IDs (the transport wait- DB) will be discarded if an old-format ID
is seen; new ones will be built with only new-format IDs.
Optionally, a utility can be used to convert spool files from old to new,
but this is only an efficiency measure not a requirement for operation
Downgrading from new to old requires running a provided utility, having
first stopped all operations. This will convert any spool files from new
back to old (losing time-precision and PID information) and remove any
wait- hints databases.
JH/30 Bug 3006: Fix handling of JSON strings having embedded commas. Previously
we treated them as item separators when parsing for a list item, but they
need to be protected by the doublequotes. While there, add handling for
backslashes.
JH/31 Bug 2998: Fix ${utf8clean:...} to disallow UTF-16 surrogate codepoints.
Found and fixed by Jasen Betts. No testcase for this as my usual text
editor insists on emitting only valid UTF-8.
JH/32 Fix "tls_dhparam = none" under GnuTLS. At least with 3.7.9 this gave
a null-indirection SIGSEGV for the receive process.
JH/33 Fix free for live variable $value created by a ${run ...} expansion during
-bh use. Internal checking would spot this and take a panic.
JH/34 Bug 3013: Fix use of $recipients within arguments for ${run...}.
In 4.96 this would expand to empty.
JH/35 Bug 3014: GnuTLS: fix expiry date for an auto-generated server
certificate. Find and fix by Andreas Metzler.
JH/36 Add ARC info to DMARC hostory records.
JH/37 Bug 3016: Avoid sending DSN when message was accepted under fakereject
or fakedefer. Previously the sender could discover that the message
had in fact been accepted.
JH/38 Taint-track intermediate values from the peer in multi-stage authentation
sequences. Previously the input was not noted as being tainted; notably
this resulted in behaviour of LOGIN vs. PLAIN being inconsistent under
bad coding of authenticators.
JH/39 Bug 3023: Fix crash induced by some combinations of zero-length strings
and ${tr...}. Found and diagnosed by Heiko Schlichting.
JH/40 Bug 2999: Fix a possible OOB write in the external authenticator, which
could be triggered by externally-supplied input. Found by Trend Micro.
CVE-2023-42115
JH/41 Bug 3000: Fix a possible OOB write in the SPA authenticator, which could
be triggered by externally-controlled input. Found by Trend Micro.
CVE-2023-42116
JH/42 Bug 3001: Fix a possible OOB read in the SPA authenticator, which could
be triggered by externally-controlled input. Found by Trend Micro.
CVE-2023-42114
JH/43 Bug 2903: avoid exit on an attempt to rewrite a malformed address.
Make the rewrite never match and keep the logging. Trust the
admin to be using verify=header-syntax (to actually reject the message).
JH/44 Bug 3033: Harden dnsdb lookups against crafted DNS responses.
CVE-2023-42219
HS/02 Fix string_is_ip_address() CVE-2023-42117 (Bug 3031)
Exim version 4.96
-----------------
JH/01 Move the wait-for-next-tick (needed for unique message IDs) from
after reception to before a subsequent reception. This should
mean slightly faster delivery, and also confirmation of reception
to senders.
JH/02 Move from using the pcre library to pcre2. The former is no longer
being developed or supported (by the original developer).
JH/03 Constification work in the filters module required a major version
bump for the local-scan API. Specifically, the "headers_charset"
global which is visible via the API is now const and may therefore
not be modified by local-scan code.
JH/04 Fix ClamAV TCP use under FreeBSD. Previously the OS-specific shim for
sendfile() didi not account for the way the ClamAV driver code called it.
JH/05 Bug 2819: speed up command-line messages being read in. Previously a
time check was being done for every character; replace that with one
per buffer.
JH/06 Bug 2815: Fix ALPN sent by server under OpenSSL. Previously the string
sent was prefixed with a length byte.
JH/07 Change the SMTP feature name for pipelining connect to be compliant with
RFC 5321. Previously Dovecot (at least) would log errors during
submission.
JH/08 Remove stripping of the binaries from the FreeBSD build. This was added
in 4.61 without a reason logged. Binaries will be bigger, which might
matter on diskspace-constrained systems, but debug is easier.
JH/09 Fix macro-definition during "-be" expansion testing. The move to
write-protected store for macros had not accounted for these runtime
additions; fix by removing this protection for "-be" mode.
JH/10 Convert all uses of select() to poll(). FreeBSD 12.2 was found to be
handing out large-numbered file descriptors, violating the usual Unix
assumption (and required by Posix) that the lowest possible number will be
allocated by the kernel when a new one is needed. In the daemon, and any
child procesees, values higher than 1024 (being bigger than FD_SETSIZE)
are not useable for FD_SET() [and hence select()] and overwrite the stack.
Assorted crashes happen.
JH/11 Fix use of $sender_host_name in daemon process. When used in certain
main-section options or in a connect ACL, the value from the first ever
connection was never replaced for subsequent connections. Found by
Wakko Warner.
JH/12 Bug 2838: Fix for i32lp64 hard-align platforms. Found for SPARC Linux,
though only once PCRE2 was introduced: the memory accounting used under
debug offset allocations by an int, giving a hard trap in early startup.
Change to using a size_t. Debug and fix by John Paul Adrian Glaubitz.
JH/13 Bug 2845: Fix handling of tls_require_ciphers for OpenSSL when a value
with underbars is given. The write-protection of configuration introduced
in 4.95 trapped when normalisation was applied to an option not needing
expansion action.
JH/14 Bug 1895: TLS: Deprecate RFC 5114 Diffie-Hellman parameters.
JH/15 Fix a resource leak in *BSD. An off-by-one error resulted in the daemon
failing to close the certificates directory, every hour or any time it
was touched.
JH/16 Debugging initiated by an ACL control now continues through into routing
and transport processes. Previously debugging stopped any time Exim
re-execs, or for processing a queued message.
JH/17 The "expand" debug selector now gives more detail, specifically on the
result of expansion operators and items.
JH/18 Bug 2751: Fix include_directory in redirect routers. Previously a
bad comparison between the option value and the name of the file to
be included was done, and a mismatch was wrongly identified.
4.88 to 4.95 are affected.
JH/19 Support for Berkeley DB versions 1 and 2 is withdrawn.
JH/20 When built with NDBM for hints DB's check for nonexistence of a name
supplied as the db file-pair basename. Previously, if a directory
path was given, for example via the autoreply "once" option, the DB
file.pag and file.dir files would be created in that directory's
parent.
JH/21 Remove the "allow_insecure_tainted_data" main config option and the
"taint" log_selector. These were previously deprecated.
JH/22 Fix static address-list lookups to properly return the matched item.
Previously only the domain part was returned.
JH/23 Bug 2864: FreeBSD: fix transport hang after 4xx/5xx response. Previously
the call into OpenSSL to send a TLS Close was being repeated; this
resulted in the library waiting for the peer's Close. If that was never
sent we waited forever. Fix by tracking send calls.
JH/24 The ${run} expansion item now expands its command string elements after
splitting. Previously it was before; the new ordering makes handling
zero-length arguments simpler. The old ordering can be obtained by
appending a new option "preexpand", after a comma, to the "run".
JH/25 Taint-check exec arguments for transport-initiated external processes.
Previously, tainted values could be used. This affects "pipe", "lmtp" and
"queryprogram" transport, transport-filter, and ETRN commands.
The ${run} expansion is also affected: in "preexpand" mode no part of
the command line may be tainted, in default mode the executable name
may not be tainted.
JH/26 Fix CHUNKING on a continued-transport. Previously the usabliility of
the the facility was not passed across execs, and only the first message
passed over a connection could use BDAT; any further ones using DATA.
JH/27 Support the PIPECONNECT facility in the smtp transport when the helo_data
uses $sending_ip_address and an interface is specified.
Previously any use of the local address in the EHLO name disabled
PIPECONNECT, the common case being to use the rDNS of it.
JH/28 OpenSSL: fix transport-required OCSP stapling verification under session
resumption. Previously verify failed because no certificate status is
passed on the wire for the restarted session. Fix by using the recorded
ocsp status of the stored session for the new connection.
JH/29 TLS resumption: the key for session lookup in the client now includes
more info that a server could potentially use in configuring a TLS
session, avoiding oferring mismatching sessions to such a server.
Previously only the server IP was used.
JH/30 Fix string_copyn() for limit greater than actual string length.
Previously the copied amount was the limit, which could result in a
overlapping memcpy for newly allocated destination soon after a
source string shorter than the limit. Found/investigated by KM.
JH/31 Bug 2886: GnuTLS: Do not free the cached creds on transport connection
close; it may be needed for a subsequent connection. This caused a
SEGV on primary-MX defer. Found/investigated by Gedalya & Andreas.
JH/32 Fix CHUNKING for a second message on a connection when the first was
rejected. Previously we did not reset the chunking-offered state, and
erroneously rejected the BDAT command. Investigation help from
Jesse Hathaway.
JH/33 Fis ${srs_encode ...} to handle an empty sender address, now returning
an empty address. Previously the expansion returned an error.
HS/01 Bug 2855: Handle a v4mapped sender address given us by a frontending
proxy. Previously these were misparsed, leading to paniclog entries.
Exim version 4.95
-----------------
JH/01 Bug 1329: Fix format of Maildir-format filenames to match other mail-
related applications. Previously an "H" was used where available info
says that "M" should be, so change to match.
JH/02 Bug 2587: Fix pam expansion condition. Tainted values are commonly used
as arguments, so an implementation trying to copy these into a local
buffer was taking a taint-enforcement trap. Fix by using dynamically
created buffers. Similar fix for radius expansion condition.
JH/03 Bug 2586: Fix listcount expansion operator. Using tainted arguments is
reasonable, eg. to count headers. Fix by using dynamically created
buffers rather than a local. Do similar fixes for ACL actions "dcc",
"log_reject_target", "malware" and "spam"; the arguments are expanded
so could be handling tainted values.
JH/04 Bug 2590: Fix -bi (newaliases). A previous code rearrangement had
broken the (no-op) support for this sendmail command. Restore it
to doing nothing, silently, and returning good status.
JH/05 Bug 2593: Fix "vacation" in Exim filter. Previously, when a "once"
record path was given (or the default used) without a leading directory
path, an error occurred on trying to open it. Use the transport's working
directory.
JH/06 Bug 2594: Change the name used for certificate name checks in the smtp
transport. Previously it was the name on the DNS A-record; use instead
the head of the CNAME chain leading there (if there is one). This seems
to align better with RFC 6125.
JH/07 Bug 2597: Fix a resource leak. Using a lookup in obtaining a value for
smtp_accept_max_per_host allocated resources which were not released
when the limit was exceeded. This eventually crashed the daemon. Fix
by adding a release action in that path.
JH/08 Bug 2598: Fix verify ACL condition. The options for the condition are
expanded; previously using tainted values was rejected. Fix by using
dynamically-created buffers.
JH/09 Relax restrictions on ACL verify condition needing access to message
headers. Previously they were only permitted in data and non-smtp ACLs;
permit also mime, dkim, prdr quit and notquit. Applies to header-syntax,
not_blind, header_sender and header_names_ascii verification.
JH/10 Bug 2603: Fix coding of string copying to only evaluate arguments once.
Previously a macro used one argument twice; when called with the
argument as an expression having side-effects, incorrect operation
resulted. Use an inlineable function.
JH/11 Bug 2604: Fix request to cutthrough-deliver when a connection is already
held open for a verify callout. Previously this wan not accounted for
and a corrupt onward SMTP conversation resulted.
JH/12 Bug 2607: Fix the ${srs_encode } expansion to handle quoted local_parts.
Previously they were embedded naively in the constructed address; when
needed, strip the quoting and quote the entire local_part.
Also make the inbound_srs expansion condition handle quoting.
JH/13 Fix dsearch "subdir" filter to ignore ".". Previously only ".." was
excluded, not matching the documentation.
JH/14 Bug 2606: Fix a segfault in sqlite lookups. When no, or a bad, filename
was given for the sqlite_dbfile a trap resulted.
JH/15 Bug 2620: Fix "spam" ACL condition. Previously, tainted values for the
"name" argument resulted in a trap. There is no reason to disallow such;
this was a coding error.
JH/16 Bug 2615: Fix pause during message reception, on systems that have been
suspended/resumed. The Linux CLOCK_MONOTONIC does not account for time
spent suspended, ignoring the POSIX definition. Previously we assumed
it did and a constant offset from real time could be used as a correction.
Change to using the same clock source for the start-of-message and the
post-message next-tick-wait. Also change to using CLOCK_BOOTTIME if it
exists, just to get a clock slightly more aligned to reality.
JH/17 Bug 2295: Fix DKIM signing to always semicolon-terminate. Although the
RFC says it is optional some validators care. The missing char was not
intended but triggered by a line-wrap alignment. Discovery and fix by
Guillaume Outters, hacked on by JH.
JH/18 Bug 2617: Fix a taint trap in parse_fix_phrase(). Previously when the
name being quoted was tainted a trap would be taken. Fix by using
dynamically created buffers. The routine could have been called by a
rewrite with the "h" flag, by using the "-F" command-line option, or
by using a "name=" option on a control=submission ACL modifier.
JH/19 SPF: change the Authentication-Results expansion component to give
smtp.helo when the sender domain is empty. Previously it gave
"smtp.mailfrom=<>"
JH/20 Bug 2631: ACL dnslist conditions now ignore and log any lookups returns
not in 127.0.0.0/8 to help in spotting list domains taken over by a
domain-parking registrar.
JH/21 Bug 2630: Fix eol-replacement string for the ${readsocket } expansion.
Previously when a whitespace character was specified it was not inserted
after removing the newline.
JH/22 Bug 2265: Force SNI usage for smtp transport DANE'd connections, to be
the domain part of the recipient address. This overrides any tls_sni
option set, which was previously used.
JH/23 Logging: with the +tls_sni log_selector, do not wrap the received SNI
in quotes.
JH/24 Bug 2634: Fix a taint trap seen on NetBSD: the testing coded for
is_tainted() had an off-by-one error in the overenthusiastic direction.
Find and fix by Gavan. Although NetBSD is not a supported platform for
4.94 this bug could affect other platforms.
PP/01 Fix default prime selection to be consistent.
One path used ike23 still, instead of exim.dev.20160529.3; now both
execution flows will use the same DH primes (currently
exim.dev.20160529.3).
JH/25 OpenSSL: Fix back-compatibility behaviour surrounding tls_certificates
option in smtp transport, to match the documentation. Previously
verification was not being done in some cases where it should have been.
JH/26 Bug 2646: fix a memory usage issue in ldap lookups. Previously, when more
than one server was defined and depending on the platform memory layout
details, an internal consistency trap could be hit while walking the list
of servers.
JH/27 Bug 2648: fix the passing of an authenticator public-name through spool
files. The value is used by the authresults expansion item. Previously
if this was used in a router or transport, a crash could result.
JH/28 Fix spurious logging of select error. Some platforms, notably FreeBSD,
have a sufficient incidence of EINTR returns from select that an
interaction with other operations done by the main daemon loop exposed
a bug in the error-handling. This was benign apart from the log
messages.
JH/29 Bug 2675: add outgoing-interface I= element to deferred "==" log lines,
for consistency with delivered "=>" and failed "**" lines. While we're
there, handle PRX and TFO.
JH/30 Bug 2677: fix matching of long addresses. Since 4.93 a limit of 256 was
applied. This resulted, if any header-line rewrite rules were configured,
in a panic-log triggerable by sending a message with a long address in
a header. Fix by increasing the arbitrary limit to larger than a single
(dewrapped) 5322 header line maximum size.
JH/31 The ESMTP option name advertised for the SUPPORT_EARLY_PIPE build option
is changed from X_PIPE_CONNECT to PIPE_CONNECT. This is in line with
RFC 6648 which deprecates X- options in protocols as a general practice.
Changeover between the implementations is handled by the mechanisms
already coded.
JH/32 Bug 2599: fix delay of delivery to a local address where there is also
a remote which uses callout/hold. Previously the local was queued.
JH/33 Fix a taint trap in the ${listextract } expansion when the source data
was tainted.
JH/34 Fix the placement of a multiple-message delivery marker in the delivery
log line. The asterisk is now consistently appended to the remote IP
(and port, if given), and will also be provided on defer and fail log
lines. Previously it could be placed on the local IP if that was being
logged, and was only provided on delivery lines.
JH/35 Bug 2343: Harden exim_tidydb against corrupt wait- files.
JH/36 Bug 2687: Fix interpretation of multiple ^ chars in a plaintext
authenticator client_send option. Previously the next char, after a pair
was collapsed, was taken verbatim (so ^^^foo became ^^foo; ^^^^foo became
^^\x00foo). Fixed to get ^\x00foo and ^^foo respectively to match the
documentation. There is still no way to get a leading ^ immediately
after a NUL (ie. for the password of a PLAIN method authenticator.
JH/37 Enforce the expected size, for fixed-size records read from hints-DB
files. For bad sizes read, delete the record and whine to paniclog.
JH/38 When logging an AUTH failure, as server, do not include sensitive
information. Previously, the credentials would be included if given
as part of the AUTH command line and an ACL denied authentication.
JH/39 Bug 2691: fix $local_part_data. When the matching list element
referred to a file, bad data was returned. This likely also affected
$domain_part_data.
JH/40 The gsasl authenticator now supports caching of the salted password
generated by the client-side implementation. This required the addition
of a new variable: $auth4.
JH/41 Fix daemon SIGHUP on FreeBSD. Previously, a named socket for IPC was
left undeleted; the attempt to re-create it then failed - resulting in
the usual "SIGHUP tp have daemon reload configuration" to not work.
This affected any platform not supporting "abstract" Unix-domain
sockets (i.e. not Linux).
JH/42 Bug 2693: Harden against a peer which reneges on a 452 "too many
recipients" response to RCPT in a later response, with a 250. The
previous coding assumed this would not happen, and under PIPELINING
would result in both lost and duplicate recipients for a message.
JH/43 Bug 2694: Fix weighted distribution of work to multiple spamd servers.
Previously the weighting was incorrectly applied. Similar fix for socks
proxies. Found and fixed by Heiko Schlichting.
JH/44 Bug 2701: Fix list-expansion of dns_ipv4_lookup. Previously, it did
not handle sub-lists included using the +namedlist syntax. While
investigating, the same found for dns_trust_aa, dns_again_means_nonexist,
dnssec_require_domains, dnssec_request_domains, srv_fail_domains,
mx_fail_domains.
JH/45 Use a (new) separate store pool-pair for DKIM verify working data.
Previously the permanent pool was used, so the store could not be freed.
This meant a connection with many messages would use continually-growing
memory.
JH/46 Use an exponentially-increasing block size when malloc'ing store. Do it
per-pool so as not to waste too much space. Previously a constant size
was used which resulted in O(n^2) behaviour; now we get O(n log n) making
DOS attacks harder. The cost is wasted memory use in the larger blocks.
JH/47 Use explicit alloc/free for DNS lookup workspace. This permits using the
same space repeatedly, and a smaller process footprint.
JH/48 Use a less bogus-looking filename for a temporary used for DH-parameters
for GnuTLS. Previously the name started "%s" which, while not a bug,
looked as if if might be one.
JH/49 Bug 2710: when using SOCKS for additional messages after the first (a
"continued connection") make the $proxy_* variables available. Previously
the information was not passed across the exec() call for subsequent
transport executions. This also mean that the log lines for the
messages can show the proxy information.
JH/50 Bug 2672: QT elements in log lines, unless disabled, now exclude the
receive time. With modern systems the difference is significant.
The historical behaviour can be restored by disabling (a new) log_selector
"queue_time_exclusive".
JH/51 Taint-check ACL line. Previously, only filenames (for out-of-line ACL
content) were specifically tested for. Now, also cover expansions
resulting in ACL names and inline ACL content.
JH/52 Fix ${ip6norm:} operator. Previously, any trailing line text was dropped,
making it unusable in complex expressions.
JH/53 Bug 2743: fix immediate-delivery via named queue. Previously this would
fail with a taint-check on the spoolfile name, and leave the message
queued.
HS/01 Enforce absolute PID file path name.
HS/02 Handle SIGINT as we handle SIGTERM: terminate the Exim process.
PP/01 Add a too-many-bad-recipients guard to the default config's RCPT ACL.
PP/02 Bug 2643: Correct TLS DH constants.
A missing NUL termination in our code-generation tool had led to some
incorrect Diffie-Hellman constants in the Exim source.
Reported by kylon94, code-gen tool fix by Simon Arlott.
PP/03 Impose security length checks on various command-line options.
Fixes CVE-2020-SPRSS reported by Qualys.
PP/04 Fix Linux security issue CVE-2020-SLCWD and guard against PATH_MAX
better. Reported by Qualys.
PP/05 Fix security issue CVE-2020-PFPSN and guard against cmdline invoker
providing a particularly obnoxious sender full name.
Reported by Qualys.
PP/06 Fix CVE-2020-28016 (PFPZA): Heap out-of-bounds write in parse_fix_phrase()
PP/07 Refuse to allocate too little memory, block negative/zero allocations.
Security guard.
PP/08 Change default for recipients_max from unlimited to 50,000.
PP/09 Fix security issue with too many recipients on a message (to remove a
known security problem if someone does set recipients_max to unlimited,
or if local additions add to the recipient list).
Fixes CVE-2020-RCPTL reported by Qualys.
PP/10 Fix security issue in SMTP verb option parsing
Fixes CVE-2020-EXOPT reported by Qualys.
PP/11 Fix security issue in BDAT state confusion.
Ensure we reset known-good where we know we need to not be reading BDAT
data, as a general case fix, and move the places where we switch to BDAT
mode until after various protocol state checks.
Fixes CVE-2020-BDATA reported by Qualys.
HS/03 Die on "/../" in msglog file names
QS/01 Creation of (database) files in $spool_dir: only uid=0 or the uid of
the Exim runtime user are allowed to create files.
QS/02 PID file creation/deletion: only possible if uid=0 or uid is the Exim
runtime user.
QS/03 When reading the output from interpreted forward files we do not
pass the pipe between the parent and the interpreting process to
executed child processes (if any).
QS/04 Always die if requested from internal logging, even is logging is
disabled.
JH/54 DMARC: recent versions of the OpenDMARC library appear to have broken
the API; compilation noo longer completes with DMARC support included.
This affects 1.4.1-1 on Fedora 33 (1.3.2-3 is functional); and has
been reported on other platforms.
JH/55 TLS: as server, reject connections with ALPN indicating non-smtp use.
JH/56 Make the majority of info read from config files readonly, for defence-in-
depth against exploits. Suggestion by Qualys.
Not supported on Solaris 10.
JH/57 Fix control=fakreject for a custom message containing tainted data.
Previously this resulted in a log complaint, due to a re-expansion present
since fakereject was originally introduced.
JH/58 GnuTLS: Fix certextract expansion. If a second modifier after a tag
modifier was given, a loop resulted.
JH/59 DKIM: Fix small-message verification under TLS with chunking. If a
pipelined SMTP command followed the BDAT LAST then it would be
incorrectly treated as part of the message body, causing a verification
fail.
JH/60 Bug 2805: Fix logging of domain-literals in Message_ID: headers. They
require looser validation rules than those for 821-level addresses,
which only permit IP addresses.