$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.333 2006/03/17 09:39:00 ph10 Exp $ Change log file for Exim from version 4.21 ------------------------------------------- Exim version 4.61 ----------------- PH/01 The code for finding all the local interface addresses on a FreeBSD system running IPv6 was broken. This may well have applied to all BSD systems, as well as to others that have similar system calls. The broken code found IPv4 interfaces correctly, but gave incorrect values for the IPv6 interfaces. In particular, ::1 was not found. The effect in Exim was that it would not match correctly against @[] and not recognize the IPv6 addresses as local. PH/02 The ipliteral router was not recognizing addresses of the form user@ [ipv6:....] because it didn't know about the "ipv6:" prefix. PH/03 Added disable_ipv6. PH/04 Changed $reply_address to use the raw form of the headers instead of the decoded form, because it is most often used to construct To: headers lines in autoreplies, and the decoded form may well be syntactically invalid. However, $reply_address has leading white space removed, and all newlines turned into spaces so that the autoreply transport does not grumble. PH/05 If group was specified without a user on a router, and no group or user was specified on a transport, the group from the router was ignored. PH/06 Increased the number of ACL variables to 20 of each type, and arranged for visible compile-time settings that can be used to change these numbers, for those that want even more. Backwards compatibility with old spool files has been maintained. However, going back to a previous Exim release will lost any variables that are in spool files. PH/07 Two small changes when running in the test harness: increase delay when passing a TCP/IP connection to a new process, in case the original process has to generate a bounce, and remove special handling of 127.0.0.2 (sic), which is no longer necessary. PH/08 Changed debug output of dbfn_open() flags from numbers to names, so as to be the same on different OS. PH/09 Moved a debug statement in filter processing to avoid a race problem when testing. JJ/01 exipick: fixed bug where -b (brief) output option showed "Vars:" whether --show-vars was specified or not JJ/02 exipick: Added support for new ACL variable spool format introduced in 4.61-PH/06 PH/10 Fixed another bug related to PH/04 above: if an incoming message had a syntactically invalid From: or Reply-to: line, and a filter used this to generate an autoreply, and therefore failed to obtain an address for the autoreply, Exim could try to deliver to a non-existent relative file name, causing unrelated and misleading errors. What now happens is that it logs this as a hard delivery error, but does not attempt to create a bounce message. PH/11 The exinext utility has a -C option for testing purposes, but although the given file was scanned by exinext itself; it wasn't being passed on when Exim was called. PH/12 In the smtp transport, treat an explicit ECONNRESET error the same as an end-of-file indication when reading a command response. PH/13 Domain literals for IPv6 were not recognized unless IPv6 support was compiled. In many other places in Exim, IPv6 addresses are always recognized, so I have changed this. It also means that IPv4 domain literals of the form [IPV4:n.n.n.n] are now always recognized. PH/14 When a uid/gid is specified for the queryprogram router, it cannot be used if the router is not running as root, for example, when verifying at ACL time, or when using -bh. The debugging output from this situation was non-existent - all you got was a failure to exec. I have made two changes: (a) Failures to set uid/gid, the current directory, or a process leader in a subprocess such as that created by queryprogram now generate suitable debugging ouput when -d is set. (b) The queryprogram router detects when it is not running as root, outputs suitable debugging information if -d is set, and then runs the subprocess without attempting to change uid/gid. PH/15 Minor change to Makefile for building test_host (undocumented testing feature). PH/16 As discussed on the list in Nov/Dec: Exim no longer looks at the additional section of a DNS packet that returns MX or SRV records. Instead, it always explicitly searches for A/AAAA records. This avoids major problems that occur when a DNS server includes only records of one type (A or AAAA) in an MX/SRV packet. A byproduct of this change has fixed another bug: if SRV records were looked up and the corresponding address records were *not* found in the additional section, the port values from the SRV records were lost. PH/17 If a delivery to a pipe, file, or autoreply was deferred, Exim was not using the correct key (the original address) when searching the retry rules in order to find which one to use for generating the retry hint. PH/18 If quota_warn_message contains a From: header, Exim now refrains from adding the default one. Similarly, if it contains a Reply-To: header, the errors_reply_to option, if set, is not used. PH/19 When calculating a retry time, Exim used to measure the "time since failure" by looking at the "first failed" field in the retry record. Now it does not use this if it is later than than the arrival time of the message. Instead it uses the arrival time. This makes for better behaviour in cases where some deliveries succeed, thus re-setting the "first failed" field. An example is a quota failure for a huge message when small messages continue to be delivered. Without this change, the "time since failure" will always be short, possible causing more frequent delivery attempts for the huge message than are intended. PH/20 Added $auth1, $auth2, $auth3 to contain authentication data (as well as $1, $2, $3) because the numerical variables can be reset during some expansion items (e.g. "match"), thereby losing the authentication data. PH/21 Make -bV show the size of off_t variables so that the test suite can decide whether to run tests for quotas > 2G. PH/22 Test the values given for quota, quota_filecount, quota_warn_threshold, mailbox_size, and mailbox_filecount in the appendfile transport. If a filecount value is greater than 2G or if a quota value is greater than 2G on a system where the size of off_t is not greater than 4, a panic error is given. PH/23 When a malformed item such as 1.2.3/24 appears in a host list, it can never match. The debug and -bh output now contains an explicit error message indicating a malformed IPv4 address or mask. PH/24 An host item such as 1.2.3.4/abc was being treated as the IP address 1.2.3.4 without a mask. Now it is not recognized as an IP address, and PH/23 above applies. PH/25 Do not write to syslog when running in the test harness. The only occasion when this arises is a failure to open the main or panic logs (for which there is an explicit test). PH/26 Added the /no_tell option to "control=freeze". PH/27 If a host name lookup failed very early in a connection, for example, if the IP address matched host_lookup and the reverse lookup yielded a name that did not have a forward lookup, an error message of the form "no IP address found for host xxx.xxx.xxx (during SMTP connection from NULL)" could be logged. Now it outputs the IP address instead of "NULL". PH/28 An enabling patch from MH: add new function child_open_exim2() which allows the sender and the authenticated sender to be set when submitting a message from within Exim. Since child_open_exim() is documented for local_scan(), the new function should be too. PH/29 In GnuTLS, a forced expansion failure for tls_privatekey was not being ignored. In both GnuTLS and OpenSSL, an expansion of tls_privatekey that results in an empty string is now treated as unset. PH/30 Fix eximon buffer overflow bug (Bugzilla #73). PH/31 Added sender_verify_fail logging option. PH/32 In November 2003, the code in Exim that added an empty Bcc: header when needed by RFC 822 but not by RFC 2822 was commented out. I have now tidied the source and removed it altogether. PH/33 When a queue run was abandoned because the load average was too high, a log line was always written; now it is written only if the queue_run log selector is set. In addition, the log line for abandonment now contains information about the queue run such as the pid. This is always present in "start" and "stop" lines but was omitted from the "abandon" line. PH/34 Omit spaces between a header name and the colon in the error message that is given when verify = headers_syntax fails (if there are lots of them, the message gets confusing). PH/35 Change the default for dns_check_names_pattern to allow slashes within names, as there are now some PTR records that contain slashes. This check is only to protect against broken name servers that fall over on strange characters, so the fact that it applies to all lookups doesn't matter. PH/36 Now that the new test suite is complete, we can remove some of the special code in Exim that was needed for the old test suite. For example, sorting DNS records because real resolvers return them in an arbitrary order. The new test suite's fake resolver always returns records in the same order. PH/37 When running in the test harness, use -odi for submitted messages (e.g. bounces) except when queue_only is set, to avoid logging races between the different processes. PH/38 Panic-die if .include specifies a non-absolute path. PH/39 A tweak to the "H" retry rule from its user. JJ/03 exipick: Removed parentheses from 'next' and 'last' calls that specified a label. They prevented compilation on older perls. JJ/04 exipick: Refactored code to prevent implicit split to @_ which caused a warning to be raised on newish perls. JJ/05 exipick: Fixed bug where -bpc always showed a count of all messages on queue. Changes to match documented behaviour of showing count of messages matching specified criteria. PH/40 Changed the default ident timeout from 30s to 5s. PH/41 Added support for the use of login_cap features, on those BSD systems that have them, for controlling the resources used by pipe deliveries. PH/42 The content-scanning code uses fopen() to create files in which to put message data. Previously it was not paying any attention to the mode of the files. Exim runs with umask(0) because the rest of the code creates files with open(), and sets the required mode explicitly. Thus, these files were ending up world-writeable. This was not a big issue, because, being within the spool directory, they were not world-accessible. I have created a function called modefopen, which takes an additional mode argument. It sets umask(777), creates the file, chmods it to the required mode, then resets the umask. All the relevant calls to fopen() in the content scanning code have been changed to use this function. PH/43 If retry_interval_max is set greater than 24 hours, it is quietly reset to 24 hours. This avoids potential overflow problems when processing G and H retry rules. I suspect nobody ever tinkers with this value. PH/44 Added STRIP_COMMAND=/usr/bin/strip to the FreeBSD Makefile. PH/45 When the plaintext authenticator is running as a client, the server's challenges are checked to ensure they are valid base64 strings. By default, the authentication attempt is cancelled if an invalid string is received. Setting client_ignore_invalid_base64 true ignores these errors. The decoded challenge strings are now placed in $auth1, $auth2, etc. as they are received. Thus, the responses can be made to depend on the challenges. If an invalid string is ignored, an empty string is placed in the variable. PH/46 Messages that are created by the autoreply transport now contains a References: header, in accordance with RFCs 2822 and 3834. PH/47 Added authenticated_sender_force to the smtp transport. PH/48 The ${prvs expansion was broken on systems where time_t was long long. PH/49 Installed latest patch from the Sieve maintainer. PH/50 When an Exim quota was set without a file count quota, and mailbox_size was also set, the appendfile transport was unnecessarily scanning a directory of message files (e.g. for maildir delivery) to find the count of files (along with the size), even though it did not need this information. It now does the scan only if it needs to find either the size of the count of files. PH/51 Added ${time_eval: to convert Exim time strings into seconds. PH/52 Two bugs concerned with error handling when the smtp transport is used in LMTP mode: (i) Exim was not creating retry information for temporary errors given for individual recipients after the DATA command when the smtp transport was used in LMTP mode. This meant that they could be retried too frequently, and not timed out correctly. (ii) Exim was setting the flag that allows error details to be returned for LMTP errors on RCPT commands, but not for LMTP errors for individual recipients that were returned after the DATA command. PH/53 This is related to PH/52, but is more general: for any failing address, when detailed error information was permitted to be returned to the sender, but the error was temporary, then after the final timeout, only "retry timeout exceeded" was returned. Now it returns the full error as well as "retry timeout exceeded". PH/54 Added control=allow_auth_unadvertised, as it seems there are clients that do this, and (what is worse) MTAs that accept it. PH/55 Added the add_header modified to ACLs. The use of "message" with "warn" will now be deprecated. PH/56 New os.c-cygwin from the Cygwin maintainer. JJ/06 exipick: added --unsorted option to allow unsorted output in all output formats (previously only available in exim formats via -bpr, -bpru, and -bpra. Now also available in native and exiqgrep formats) JJ/07 exipick: added --freeze and --thaw options to allow faster interaction with very large, slow to parse queues JJ/08 exipick: added ! as generic prefix to negate any criteria format JJ/09 exipick: miscellaneous performance enhancements (~24% improvements) PH/57 Tidies in SMTP dialogue display in debug output: (i) It was not showing responses to authentication challenges, though it was showing the challenges; (ii) I've removed the CR characters from the debug output for SMTP output lines. PH/58 Allow for the insertion of a newline as well as a space when a string is turned into more than one encoded-word during RFC 2047 encoding. The Sieve code now uses this. PH/59 Added the following errors that can be detected in retry rules: mail_4xx, data_4xx, lost_connection, tls_required. PH/60 When a VRFY deferred or FAILED, the log message rather than the user message was being sent as an SMTP response. PH/61 Add -l and -k options to exicyclog. PH/62 When verifying, if an address was redirected to one new address, so that verification continued, and the new address failed or deferred after having set something in $address_data, the value of $address_data was not passed back to the ACL. This was different to the case when no redirection occurred. The value is now passed back in both cases. PH/63 Changed the macro HAVE_LOGIN_CAP (see PH/41 for this release above) to HAVE_SETCLASSRESOURCES because there are different APIs in use that all use login_cap.h, so on its own it isn't the distinguishing feature. The new name refers directly to the setclassresources() function. PH/65 Added configuration files for NetBSD3. PH/66 Updated OS/Makefile-HP-UX for gcc 4.1.0 with HP-UX 11. Exim version 4.60 ----------------- PH/01 Two changes to the default runtime configuration: (1) Move the checks for relay_from_hosts and authenticated clients from after to before the (commented out) DNS black list checks. (2) Add control=submission to the relay_from_hosts and authenticated clients checks, on the grounds that messages accepted by these statements are most likely to be submissions. PH/02 Several tidies to the handling of ${prvs and ${prvscheck: (1) Generate an error if the third argument for the ${prvs expansion is not a single digit. (2) Treat a missing third argument of ${prvscheck as if it were an empty string. (3) Reset the variables that are obtained from the first argument of ${prvscheck and used in the second argument before leaving the code, because their memory is reclaimed, so using them afterwards may do silly things. (4) Tidy up the code for expanding the arguments of ${prvscheck one by one (it's much easier than Tom thought :-). (5) Because of (4), we can now allow for the use of $prvscheck_result inside the third argument. PH/03 For some reason, the default setting of PATH when running a command from a pipe transport was just "/usr/bin". I have changed it to "/bin:/usr/bin". PH/04 SUPPORT_TRANSLATE_IP_ADDRESS and MOVE_FROZEN_MESSAGES did not cause anything to be listed in the output from -bV. PH/05 When a filter generated an autoreply, the entire To: header line was quoted in the delivery log line, like this: => >A.N.Other ... This has been changed so that it extracts the operative address. There may be more than one such address. If so, they are comma-separated, like this: => >ano@some.domain,ona@other.domain ... PH/06 When a client host used a correct literal IP address in a HELO or EHLO command, (for example, EHLO [1.2.3.4]) and the client's IP address was not being looked up in the rDNS to get a host name, Exim was showing the IP address twice in Received: lines, even though the IP addresses were identical. For example: Received: from [1.2.3.4] (helo=[1.2.3.4]) However, if the real host name was known, it was omitting the HELO data if it matched the actual IP address. This has been tidied up so that it doesn't show the same IP address twice. PH/07 When both +timestamp and +memory debugging was on, the value given by $tod_xxx expansions could be wrong, because the tod_stamp() function was called by the debug printing, thereby overwriting the timestamp buffer. Debugging no longer uses the tod_stamp() function when +timestamp is set. PH/08 When the original message was included in an autoreply transport, it always said "this is a copy of the message, including all the headers", even if body_only or headers_only was set. It now gives an appropriate message. PH/09 Applied a patch from the Sieve maintainer which: o fixes some comments o adds the (disabled) notify extension core o adds some debug output for the result of if/elsif tests o points to the current vacation draft in the documentation and documents the missing references header update and most important: o fixes a bug in processing the envelope test (when testing multiple envelope elements, the last element determinted the result) PH/10 Exim was violating RFC 3834 ("Recommendations for Automatic Responses to Electronic Mail") by including: Auto-submitted: auto-generated in the messages that it generates (bounce messages and others, such as warnings). In the case of bounce messages for non-SMTP mesages, there was also a typo: it was using "Auto_submitted" (underscore instead of hyphen). Since every message generated by Exim is necessarily in response to another message, thes have all been changed to: Auto-Submitted: auto-replied in accordance with these statements in the RFC: The auto-replied keyword: - SHOULD be used on messages sent in direct response to another message by an automatic process, - MUST NOT be used on manually-generated messages, - MAY be used on Delivery Status Notifications (DSNs) and Message Disposition Notifications (MDNs), - MUST NOT be used on messages generated by automatic or periodic processes, except for messages which are automatic responses to other messages. PH/11 Added "${if def:sender_address {(envelope-from <$sender_address>)\n\t}}" to the default Received: header definition. PH/12 Added log selector acl_warn_skipped (default on). PH/13 After a successful wildlsearch lookup, discard the values of numeric variables because (a) they are in the wrong storage pool and (b) even if they were copied, it wouldn't work properly because of the caching. PH/14 Add check_rfc2047_length to disable enforcement of RFC 2047 length checking when decoding. Apparently there are clients that generate overlong encoded strings. Why am I not surprised? PH/15 If the first argument of "${if match_address" was not empty, but did not contain an "@" character, Exim crashed. Now it writes a panic log message and treats the condition as false. PH/16 In autoreply, treat an empty string for "once" the same as unset. PH/17 A further patch from the Sieve maintainer: "Introduce the new Sieve extension "envelope-auth". The code is finished and in agreement with other implementations, but there is no documentation so far and in fact, nobody wrote the draft yet. This extension is currently #undef'ed, thus not changing the active code. Print executed "if" and "elsif" statements when debugging is used. This helps a great deal to understand what a filter does. Document more things not specified clearly in RFC3028. I had all this sorted out, when out of a sudden new issues came to my mind. Oops." PH/18 Exim was not recognizing the "net-" search type prefix in match_ip lists (Bugzilla #53). PH/19 Exim expands the IPv6 address given to -bh to its full non-abbreviated canonical form (as documented). However, after a host name lookup from the IP address, check_host() was doing a simple string comparison with addresses acquired from the DNS when checking that the found name did have the original IP as one of its addresses. Since any found IPv6 addresses are likely to be in abbreviated form, the comparison could fail. Luckily, there already exists a function for doing the comparison by converting both addresses to binary, so now that is used instead of the text comparison. PH/20 There was another similar case to PH/19, when a complete host name was given in a host list; looking up its IP address could give an abbreviated form, whereas the current host's name might or might not be abbreviated. The same fix has been applied. Exim version 4.54 ----------------- PH/01 The ${base62: operator adjusted itself to base 36 when BASE_62 was set to 36 (for Darwin and Cygwin), but the ${base62d: operator did not. It now does. PH/02 Two minor problems detected in Cygwin: the os.{c,h} files had lost */ on the CVS lines, and there was a missing #if HAVE_IPV6 in host.c. PH/03 Typo: missing ".o" in src/pcre/Makefile. PH/04 Tighten up "personal" tests: Instead of testing for any "List-" header line, restrict the check to what is listed in RFCs 2369 and 2929. Also, for "Auto-Submitted", treat anything other than "no" as non-personal, in accordance with RFC 3834. (Previously it treated anything starting "auto-" as non-personal.) TF/01 The control=submission/name=... option had a problem with syntax errors if the name included a slash character. The /name= option now slurps the rest of the string, so it can include any characters but it must come last in the list of options (after /sender_retain or /domain=). PH/05 Some modifications to the interface to the fake nameserver for the new testing suite. Exim version 4.53 ----------------- TK/01 Added the "success_on_redirect" address verification option. See NewStuff for rationale and an example. PH/01 Added support for SQLite, basic code supplied by David Woodhouse. PH/02 Patch to exigrep to allow it to work on syslog lines. PH/03 When creating an mbox file for a virus/spam scan, use fseek() instead of fread() to skip over the body file's header line, because in Cygwin the header line is locked and is inaccessible. PH/04 Added $message_exim_id, ultimately to replace $message_id (they will both co-exist for some time) to make it clear that it is the Exim ID that is referenced, not the Message-ID: header line. PH/05 Replaced all Tom's calls to snprintf() with calls to the internal string_format() function, because snprintf() does not exist on all operating systems. PH/06 The use of forbid_filter_existstest now also locks out the use of the ${stat: expansion item. PH/07 Changed "SMTP protocol violation: synchronization error" into "SMTP protocol synchronization error", to keep the pedants happy. PH/08 Arrange for USE_INET_NTOA_FIX to be set in config.h for AIX systems as well as for IRIX systems, when gcc is being used. See the host.c source file for comments. PH/09 Installed latest Cygwin configuration files from the Cygwin maintainer. PH/10 Named domain lists were not working if used in a queue_smtp_domains setting. PH/11 Added support for the IGNOREQUOTA extension to LMTP, both to the lmtp transport and to the smtp transport in LMTP mode. TK/02 Remove one case of BASE64 error detection FTTB (undocumented anyway). PH/12 There was a missing call to search_tidyup() before the fork() in rda.c to run a filter in a subprocess. This could lead to confusion in subsequent lookups in the parent process. There should also be a search_tidyup() at the end of the subprocess. PH/13 Previously, if "verify = helo" was set in an ACL, the condition was true only if the host matched helo_try_verify_hosts, which caused the verification to occur when the EHLO/HELO command was issued. The ACL just tested the remembered result. Now, if a previous verification attempt has not happened, "verify = helo" does it there and then. JJ/01 exipick: added $message_exim_id variable (see 4.53-PH/04) TK/03 Fix log output including CR from clamd. PH/14 A reference to $reply_address when Reply-to: was empty and From: did not exist provoked a memory error which could cause a segfault. PH/15 Installed PCRE 6.2 PH/17 Defined BIND_8_COMPAT in the Darwin os.h file. PH/18 Reversed 4.52/PH/17 because the HP-UX user found it wasn't the cause of the problem. Specifically, suggested +O2 rather than +O1 for the HP-UX compiler. PH/19 Added sqlite_lock_timeout option (David Woodhouse's patch). PH/20 If a delivery was routed to a non-standard port by means of an SRV record, the port was not correctly logged when the outgoing_port log selector was set (it logged the transort's default port). PH/21 Added support for host-specific ports to manualroute, queryprogram, fallback_hosts, and "hosts" in the smtp transport. PH/22 If the log selector "outgoing_port" is set, the port is now also given on host errors such as "Connection refused". PH/23 Applied a patch to fix problems with exim-4.52 while doing radius authentication with radiusclient 0.4.9: - Error returned from rc_read_config was caught wrongly - Username/password not passed on to radius server due to wrong length. The presumption is that some radiusclient API changes for 4.51/PH/17 were not taken care of correctly. The code is still untested by me (my Linux distribution still has 0.3.2 of radiusclient), but it was contributed by a Radius user. PH/24 When doing a callout, the value of $domain wasn't set correctly when expanding the "port" option of the smtp transport. TK/04 MIME ACL: Fix buffer underrun that occurs when EOF condition is met while reading a MIME header. Thanks to Tom Hughes for a patch. PH/24 Include config.h inside local_scan.h so that configuration settings are available. PH/25 Make $smtp_command_argument available after all SMTP commands. This means that in an ACL for RCPT (for example), you can examine exactly what was received. PH/26 Exim was recognizing IPv6 addresses of the form [IPv6:....] in EHLO commands, but it was not correctly comparing the address with the actual client host address. Thus, it would show the EHLO address in Received: header lines when this was not necessary. PH/27 Added the % operator to ${eval:}. PH/28 Exim tries to create and chdir to its spool directory when it starts; it should be ignoring failures (because with -C, for example, it has lost privilege). It wasn't ignoring creation failures other than "already exists". PH/29 Added "crypteq" to the list of supported features that Exim outputs when -bV or -d is used. PH/30 Fixed (presumably very longstanding) bug in exim_dbmbuild: if it failed because an input line was too long, either on its own, or by virtue of too many continuations, the temporary file was not being removed, and the return code was incorrect. PH/31 Missing "BOOL" in function definition in filtertest.c. PH/32 Applied Sieve patches from the maintainer. TK/05 Domainkeys: Accomodate for a minor API change in libdomainkeys 0.67. PH/33 Added "verify = not_blind". PH/34 There are settings for CHOWN_COMMAND and MV_COMMAND that can be used in Local/Makefile (with some defaults set). These are used in built scripts such as exicyclog, but they have never been used in the exim_install script (though there are many overriding facilities there). I have arranged that the exim_install script now takes note of these two settings. PH/35 Installed configuration files for Dragonfly. PH/36 When a locally submitted message by a trusted user did not contain a From: header, and the sender address was obtained from -f or from an SMTP MAIL command, and the trusted user did not use -F to supply a sender name, $originator_name was incorrectly used when constructing a From: header. Furthermore, $originator_name was used for submission mode messages from external hosts without From: headers in a similar way, which is clearly wrong. PH/37 Added control=suppress_local_fixups. PH/38 When log_selector = +received_sender was set, and the addition of the sender made the log line's construction buffer exactly full, or one byte less than full, an overflow happened when the terminating "\n" was subsequently added. PH/39 Added a new log selector, "unknown_in_list", which provokes a log entry when the result of a list match is failure because a DNS lookup failed. PH/40 RM_COMMAND is now used in the building process. PH/41 Added a "distclean" target to the top-level Makefile; it deletes all the "build-* directories that it finds. PH/42 (But a TF fix): In a domain list, Exim incorrectly matched @[] if the IP address in a domain literal was a prefix of an interface address. PH/43 (Again a TF fix): In the dnslookup router, do not apply widen_domains when verifying a sender address, unless rewrite_headers is false. PH/44 Wrote a long comment about why errors_to addresses are verified as recipients, not senders. TF/01 Add missing LIBS=-lm to OS/Makefile-OpenBSD which was overlooked when the ratelimit ACL was added. PH/45 Added $smtp_command for the full command (cf $smtp_command_argument). PH/46 Added extra information about PostgreSQL errors to the error string. PH/47 Added an interface to a fake DNS resolver for use by the new test suite, avoiding the need to install special zones in a real server. This is backwards compatible; if it can't find the fake resolver, it drops back. Thus, both old and new test suites can be run. TF/02 Added util/ratelimit.pl TF/03 Minor fix to the ratelimit code to improve its behaviour in case the clock is set back in time. TF/04 Fix the ratelimit support in exim_fixdb. Patch provided by Brian Candler . TF/05 The fix for PH/43 was not completely correct; widen_domains is always OK for addresses that are the result of redirections. PH/48 A number of further additions for the benefit of the new test suite, including a fake gethostbyname() that interfaces to the fake DNS resolver (see PH/47 above). TF/06 The fix for widen_domains has also been applied to qualify_single and search_parents which are the other dnslookup options that can cause header rewrites. PH/49 Michael Haardt's randomized retrying, but as a separate retry parameter type ("H"). PH/50 Make never_users, trusted_users, admin_groups, trusted_groups expandable. TF/07 Exim produced the error message "an SRV record indicated no SMTP service" if it encountered an MX record with an empty target hostname. The message is now "an MX or SRV record indicated no SMTP service". TF/08 Change PH/13 introduced the possibility that verify=helo may defer, if the DNS of the sending site is misconfigured. This is quite a common situation. This change restores the behaviour of treating a helo verification defer as a failure. PH/51 If self=fail was set on a router, the bounce message did not include the actual error message. Exim version 4.52 ----------------- TF/01 Added support for Client SMTP Authorization. See NewStuff for details. PH/01 When a transport filter timed out in a pipe delivery, and the pipe command itself ended in error, the underlying message about the transport filter timeout was being overwritten with the pipe command error. Now the underlying error message should be appended to the second error message. TK/01 Fix poll() being unavailable on Mac OSX 10.2. PH/02 Reduce the amount of output that "make" produces by default. Full output can still be requested. PH/03 The warning log line about a condition test deferring for a "warn" verb was being output only once per connection, rather than after each occurrence (because it was using the same function as for successful "warn" verbs). This seems wrong, so I have changed it. TF/02 Two buglets in acl.c which caused Exim to read a few bytes of memory that it should not have, which might have caused a crash in the right circumstances, but probably never did. PH/04 Installed a modified version of Tony Finch's patch to make submission mode fix the return path as well as the Sender: header line, and to add a /name= option so that you can make the user's friendly name appear in the header line. TF/03 Added the control = fakedefer ACL modifier. TF/04 Added the ratelimit ACL condition. See NewStuff for details. Thanks to Mark Lowes for thorough testing. TK/02 Rewrote SPF support to work with libspf2 versions >1.2.0. TK/03 Merged latest SRS patch from Miles Wilton. PH/05 There's a shambles in IRIX6 - it defines EX_OK in unistd.h which conflicts with the definition in sysexits.h (which is #included earlier). Fortunately, Exim does not actually use EX_OK. The code used to try to preserve the sysexits.h value, by assumimg that macro definitions were scanned for macro replacements. I have been disabused of this notion, so now the code just undefines EX_OK before #including unistd.h. PH/06 There is a timeout for writing blocks of data, set by, e.g. data_timeout in the smtp transport. When a block could not be written in a single write() function, the timeout was being re-applied to each part-write. This seems wrong - if the receiver was accepting one byte at a time it would take for ever. The timeout is now adjusted when this happens. It doesn't have to be particularly precise. TK/04 Added simple SPF lookup method in EXPERIMENTAL_SPF. See NewStuff for details. Thanks to Chris Webb for the patch! PH/07 Added "fullpostmaster" verify option, which does a check to without a domain if the check to fails. SC/01 Eximstats: added -xls and the ability to specify output files (patch written by Frank Heydlauf). SC/02 Eximstats: use FileHandles for outputing results. SC/03 Eximstats: allow any combination of xls, txt, and html output. SC/04 Eximstats: fixed display of large numbers with -nvr option SC/05 Eximstats: fixed merging of reports with empty tables. SC/06 Eximstats: added the -include_original_destination flag SC/07 Eximstats: removed tabs and trailing whitespace. TK/05 Malware: Improve on aveserver error handling. Patch from Alex Miller. TK/06 MBOX spool code: Add real "From " MBOX separator line so the .eml file is really in mbox format (even though most programs do not really care). Patch from Alex Miller. TK/07 MBOX spool code: Add X-Envelope-From: and X-Envelope-To: headers. The latter is generated from $received_to and is only set if the message has one envelope recipient. SA can use these headers, obviously out-of-the-box. Patch from Alex Miller. PH/08 The ${def test on a variable was returning false if the variable's value was "0", contrary to what the specification has always said! The result should be true unless the variable is empty. PH/09 The syntax error of a character other than { following "${if def:variable_name" (after optional whitespace) was not being diagnosed. An expansion such as ${if def:sender_ident:{xxx}{yyy}} in which an accidental colon was present, for example, could give incorrect results. PH/10 Tidied the code in a number of places where the st_size field of a stat() result is used (not including appendfile, where other changes are about to be made). PH/11 Upgraded appendfile so that quotas larger than 2G are now supported. This involved changing a lot of size variables from int to off_t. It should work with maildirs and everything. TK/08 Apply fix provided by Michael Haardt to prevent deadlock in case of spamd dying while we are connected to it. TF/05 Fixed a ${extract error message typo reported by Jeremy Harris PH/12 Applied Alex Kiernan's patch for the API change for the error callback function for BDB 4.3. PH/13 Changed auto_thaw such that it does not apply to bounce messages. PH/14 Imported PCRE 6.0; this was more than just a trivial operation because the sources for PCRE have been re-arranged and more files are now involved. PH/15 The code I had for printing potentially long long variables in PH/11 above was not the best (it lost precision). The length of off_t variables is now inspected at build time, and an appropriate printing format (%ld or %lld) is chosen and #defined by OFF_T_FMT. We also define LONGLONG_T to be "long long int" or "long int". This is needed for the internal formatting function string_vformat(). PH/16 Applied Matthew Newton's patch to exicyclog: "If log_file_path is set in the configuration file to be ":syslog", then the script "guesses" where the logs files are, rather than using the compiled in default. In our case the guess is not the same as the compiled default, so the script suddenly stopped working when I started to use syslog. The patch checks to see if log_file_path is "". If so, it attempts to read it from exim with no configuration file to get the compiled in version, before it falls back to the previous guessing code." TK/09 Added "prvs" and "prvscheck" expansion items. These help a lot with implementing BATV in an Exim configuration. See NewStuff for the gory details. PH/17 Applied Michael Haardt's patch for HP-UX, affecting only the os.h and Makefile that are specific to HP-UX. PH/18 If the "use_postmaster" option was set for a recipient callout together with the "random" option, the postmaster address was used as the MAIL FROM address for the random test, but not for the subsequent recipient test. It is now used for both. PH/19 Applied Michael Haardt's patch to update Sieve to RFC3028bis. "The patch removes a few documentation additions to RFC 3028, because the latest draft now contains them. It adds the new en;ascii-case comparator and a new error check for 8bit text in MIME parts. Comparator and require names are now matched exactly. I enabled the subaddress extension, but it is not well tested yet (read: it works for me)." PH/20 Added macros for time_t as for off_t (see PH/15 above) and used them to rework some of the code of TK/09 above to avoid the hardwired use of "%lld" and "long long". Replaced the call to snprintf() with a call to string_vformat(). PH/21 Added some other messages to those in 4.51/PH/42, namely "All relevant MX records point to non-existent hosts", "retry timeout exceeded", and "retry time not reached for any host after a long failure period". PH/22 Fixed some oversights/typos causing bugs when Exim is compiled with experimental DomainKeys support: (1) The filter variables $n0-$n9 and $sn0-$sn9 were broken. (2) On an error such as an illegally used "control", the wrong name for the control was given. These problems did NOT occur unless DomainKeys support was compiled. PH/23 Added daemon_startup_retries and daemon_startup_sleep. PH/24 Added ${if match_ip condition. PH/25 Put debug statements on either side of calls to EXIM_DBOPEN() for hints databases so that it will be absolutely obvious if a crash occurs in the DB library. This is a regular occurrence (often caused by mis-matched db.h files). PH/26 Insert a lot of missing (void) casts for functions such as chown(), chmod(), fcntl(), sscanf(), and other functions from stdio.h. These were picked up on a user's system that detects such things. There doesn't seem to be a gcc warning option for this - only an attribute that has to be put on the function's prototype. It seems that in Fedora Core 4 they have set this on a number of new functions. No doubt there will be more in due course. PH/27 If a dnslookup or manualroute router is set with verify=only, it need not specify a transport. However, if an address that was verified by such a router was the subject of a callout, Exim crashed because it tried to read the rcpt_include_affixes from the non-existent transport. Now it just assumes that the setting of that option is false. This bug was introduced by 4.51/PH/31. PH/28 Changed -d+all to exclude +memory, because that information is very rarely of interest, but it makes the output a lot bigger. People tend to do -d+all out of habit. PH/29 Removed support for the Linux-libc5 build, as it is obsolete and the code in os-type was giving problems when libc.so lives in lib64, like on x86_64 Fedora Core. PH/30 Exim's DNS code uses the original T_xxx names for DNS record times. These aren't the modern standard, and it seems that some systems' include files don't always have them. Exim was already checking for some of the newer ones like T_AAAA, and defining it itself. I've added checks for all the record types that Exim uses. PH/31 When using GnuTLS, if the parameters cache file did not exist, Exim was not automatically generating a new one, as it is supposed to. This prevented TLS from working. If the file did exist, but contained invalid data, a new version was generated, as expected. It was only the case of a non-existent file that was broken. TK/10 Domainkeys: Fix a bug in verification that caused a crash in conjunction with a change in libdomainkeys > 0.64. TK/11 Domainkeys: Change the logic how the "testing" policy flag is retrieved from DNS. If the selector record carries the flag, it now has precedence over the domain-wide flag. TK/12 Cleared some compiler warnings related to SPF, SRS and DK code. PH/32 In mua_wrapper mode, if an smtp transport configuration error (such as the use of a port name that isn't defined in /etc/services) occurred, the message was deferred as in a normal delivery, and thus remained on the spool, instead of being failed because of the mua_wrapper setting. This is now fixed, and I tidied up some of the mua_wrapper messages at the same time. SC/08 Eximstats: whilst parsing the mainlog(s), store information about the messages in a hash of arrays rather than using individual hashes. This is a bit cleaner and results in dramatic memory savings, albeit at a slight CPU cost. SC/09 Eximstats: added the -show_rt and the -show_dt flags as requested by Marc Sherman. SC/10 Eximstats: added histograms for user specified patterns as requested by Marc Sherman. SC/11 Eximstats: v1.43 - bugfix for pattern histograms with -h0 specified. PH/33 Patch from the Cygwin maintainer to add "b" to all occurences of fopen() in the content-scanning modules that did not already have it. Exim version 4.51 ----------------- TK/01 Added Yahoo DomainKeys support via libdomainkeys. See doc/experimental-spec.txt for details. (http://domainkeys.sf.net) TK/02 Fix ACL "control" statement not being available in MIME ACL. TK/03 Fix ACL "regex" condition not being available in MIME ACL. PH/01 Installed a patch from the Sieve maintainer that allows -bf to be used to test Sieve filters that use "vacation". PH/02 Installed a slightly modified version of Nikos Mavrogiannopoulos' patch that changes the way the GnuTLS parameters are stored in the cache file. The new format can be generated externally. For backward compatibility, if the data in the cache doesn't make sense, Exim assumes it has read an old-format file, and it generates new data and writes a new file. This means that you can't go back to an older release without removing the file. PH/03 A redirect router that has both "unseen" and "one_time" set does not work if there are any delivery delays because "one_time" forces the parent to be marked "delivered", so its unseen clone is never tried again. For this reason, Exim now forbids the simultaneous setting of these two options. PH/04 Change 4.11/85 fixed an obscure bug concerned with addresses that are redirected to themselves ("homonym" addresses). Read the long ChangeLog entry if you want to know the details. The fix, however, neglected to consider the case when local delivery batching is involved. The test for "previously delivered" was not happening when checking to see if an address could be batched with a previous (undelivered) one; under certain circumstances this could lead to multiple deliveries to the same address. PH/05 Renamed the macro SOCKLEN_T as EXIM_SOCKLEN_T because AIX uses SOCKLEN_T in its include files, and this causes problems building Exim. PH/06 A number of "verify =" ACL conditions have no options (e.g. verify = header_syntax) but Exim was just ignoring anything given after a slash. In particular, this caused confusion with an attempt to use "verify = reverse_host_lookup/defer_ok". An error is now given when options are supplied for verify items that do not have them. (Maybe reverse_host_ lookup should have a defer_ok option, but that's a different point.) PH/07 Increase the size of the buffer for incoming SMTP commands from 512 (as defined by RFC 821) to 2048, because there were problems with some AUTH commands, and RFC 1869 says the size should be increased for extended SMTP commands that take arguments. PH/08 Added ${dlfunc dynamically loaded function for expansion (code from Tony Finch). PH/09 Previously, an attempt to use ${perl when it wasn't compiled gave an "unknown" error; now it says that the functionality isn't in the binary. PH/10 Added a nasty fudge to try to recognize and flatten LDAP passwords in an address' error message when a string expansion fails (syntax or whatever). Otherwise the password may appear in the log. Following change PH/42 below, there is no longer a chance of it appearing in a bounce message. PH/11 Installed exipick version 20050225.0 from John Jetmore. PH/12 If the last host in a fallback_hosts list was multihomed, only the first of its addresses was ever tried. (Bugzilla bug #2.) PH/13 If "headers_add" in a transport didn't end in a newline, Exim printed the result incorrectly in the debug output. (It correctly added a newline to what was transported.) TF/01 Added $received_time. PH/14 Modified the default configuration to add an acl_smtp_data ACL, with commented out examples of how to interface to a virus scanner and to SpamAssassin. Also added commented examples of av_scanner and spamd_address settings. PH/15 Further to TK/02 and TK/03 above, tidied up the tables of what conditions and controls are allowed in which ACLs. There were a couple of minor errors. Some of the entries in the conditions table (which is a table of where they are NOT allowed) were getting very unwieldy; rewrote them as a negation of where the condition IS allowed. PH/16 Installed updated OS/os.c-cygwin from the Cygwin maintainer. PH/17 The API for radiusclient changed at release 0.4.0. Unfortunately, the header file does not have a version number, so I've had to invent a new value for RADIUS_LIB_TYPE, namely "RADIUSCLIENTNEW" to request the new API. The code is untested by me (my Linux distribution still has 0.3.2 of radiusclient), but it was contributed by a Radius user. PH/18 Installed Lars Mainka's patch for the support of CRL collections in files or directories, for OpenSSL. PH/19 When an Exim process that is running as root has to create an Exim log file, it does so in a subprocess that runs as exim:exim so as to get the ownership right at creation (otherwise, other Exim processes might see the file with the wrong ownership). There was no test for failure of this fork() call, which would lead to the process getting stuck as it waited for a non-existent subprocess. Forks do occasionally fail when resources run out. I reviewed all the other calls to fork(); they all seem to check for failure. PH/20 When checking for unexpected SMTP input at connect time (before writing the banner), Exim was not dealing correctly with a non-positive return from the read() function. If the client had disconnected by this time, the result was a log entry for a synchronization error with an empty string after "input=" when read() returned zero. If read() returned -1 (an event I could not check), uninitialized data bytes were printed. There were reports of junk text (parts of files, etc) appearing after "input=". PH/21 Added acl_not_smtp_mime to allow for MIME scanning for non-SMTP messages. PH/22 Added support for macro redefinition, and (re)definition in between driver and ACL definitions. PH/23 The cyrus_sasl authenticator was expanding server_hostname, but then forgetting to use the resulting value; it was using the unexpanded value. PH/24 The cyrus_sasl authenticator was advertising mechanisms for which it hadn't been configured. The fix is from Juergen Kreileder, who understands it better than I do: "Here's what I see happening with three configured cyrus_sasl authenticators configured (plain, login, cram-md5): On startup auth_cyrus_sasl_init() gets called for each of these. This means three calls to sasl_listmech() without a specified mech_list. => SASL tests which mechs of all available mechs actually work => three warnings about OTP not working => the returned list contains: plain, login, cram-md5, digest-md5, ... With the patch, sasl_listmech() also gets called three times. But now SASL's mech_list option is set to the server_mech specified in the the authenticator. Or in other words, the answer from sasl_listmech() gets limited to just the mech you're testing for (which is different for each call.) => the return list contains just 'plain' or 'login', 'cram-md5' or nothing depending on the value of ob->server_mech. I've just tested the patch: Authentication still works fine, unavailable mechs specified in the exim configuration are still caught, and the auth.log warnings about OTP are gone." PH/25 When debugging is enabled, the contents of the command line are added to the debugging output, even when log_selector=+arguments is not specified. PH/26 Change scripts/os-type so that when "uname -s" returns just "GNU", the answer is "GNU", and only if the return is "GNU/something" is the answer "Linux". PH/27 $acl_verify_message is now set immediately after the failure of a verification in an ACL, and so is available in subsequent modifiers. In particular, the message can be preserved by coding like this: warn !verify = sender set acl_m0 = $acl_verify_message Previously, $acl_verify_message was set only while expanding "message" and "log_message" when a very denied access. PH/28 Modified OS/os.c-Linux with -#ifndef OS_LOAD_AVERAGE +#if !defined(OS_LOAD_AVERAGE) && defined(__linux__) to make Exim compile on kfreebsd-gnu. (I'm totally confused about the nomenclature these days.) PH/29 Installed patch from the Sieve maintainer that adds the options sieve_useraddress and sieve_subaddress to the redirect router. PH/30 In these circumstances: . Two addresses routed to the same list of hosts; . First host does not offer TLS; . First host accepts first address; . First host gives temporary error to second address; . Second host offers TLS and a TLS session is established; . Second host accepts second address. Exim incorrectly logged both deliveries with the TLS parameters (cipher and peerdn, if requested) that were in fact used only for the second address. PH/31 When doing a callout as part of verifying an address, Exim was not paying attention to any local part prefix or suffix that was matched by the router that accepted the address. It now behaves in the same way as it does for delivery: the affixes are removed from the local part unless rcpt_include_affixes is set on the transport. PH/32 Add the sender address, as F=<...>, to the log line when logging a timeout during the DATA phase of an incoming message. PH/33 Sieve envelope tests were broken for match types other than :is. I have applied a patch sanctioned by the Sieve maintainer. PH/34 Change 4.50/80 broke Exim in that it could no longer handle cases where the uid or gid is negative. A case of a negative gid caused this to be noticed. The fix allows for either to be negative. PH/35 ACL_WHERE_MIME is now declared unconditionally, to avoid too much code clutter, but the tables that are indexed by ACL_WHERE_xxx values had been overlooked. PH/36 The change PH/12 above was broken. Fixed it. PH/37 Exim used to check for duplicate addresses in the middle of routing, on the grounds that routing the same address twice would always produce the same answer. This might have been true once, but it is certainly no longer true now. Routing a child address may depend on the previous routing that produced that child. Some complicated redirection strategies went wrong when messages had multiple recipients, and made Exim's behaviour dependent on the order in which the addresses were given. I have moved the duplicate checking until after the routing is complete. Exim scans the addresses that are assigned to local and remote transports, and removes any duplicates. This means that more work will be done, as duplicates will always all be routed, but duplicates are presumably rare, so I don't expect this is of any significance. For deliveries to pipes, files, and autoreplies, the duplicate checking still happens during the routing process, since they are not going to be routed further. PH/38 Installed a patch from Ian Freislich, with the agreement of Tom Kistner. It corrects a timeout issue with spamd. This is Ian's comment: "The background is that sometimes spamd either never reads data from a connection it has accepted, or it never writes response data. The exiscan spam.[ch] uses a 3600 second timeout on spamd socket reads, further, it blindly assumes that writes won't block so it may never time out." PH/39 Allow G after quota size as well as K and M. PH/40 The value set for $authenticated_id in an authenticator may not contain binary zeroes or newlines because the value is written to log lines and to spool files. There was no check on this. Now the value is run through the string_printing() function so that such characters are converted to printable escape sequences. PH/41 $message_linecount is a new variable that contains the total number of lines in the message. Compare $body_linecount, which is the count for the body only. PH/42 Exim no longer gives details of delivery errors for specific addresses in bounce and delay warning messages, except in certain special cases, which are as follows: (a) An SMTP error message from a remote host; (b) A message specified in a :fail: redirection; (c) A message specified in a "fail" command in a system filter; (d) A message specified in a FAIL return from the queryprogram router; (e) A message specified by the cannot_route_message router option. In these cases only, Exim does include the error details in bounce and warning messages. There are also a few cases where bland messages such as "unrouteable address" or "local delivery error" are given. PH/43 $value is now also set for the "else" part of a ${run expansion. PH/44 Applied patch from the Sieve maintainer: "The vacation draft is still being worked on, but at least Exim now implements the latest version to play with." PH/45 In a pipe transport, although a timeout while waiting for the pipe process to complete was treated as a delivery failure, a timeout while writing the message to the pipe was logged, but erroneously treated as a successful delivery. Such timeouts include transport filter timeouts. For consistency with the overall process timeout, these timeouts are now treated as errors, giving rise to delivery failures by default. However, there is now a new Boolean option for the pipe transport called timeout_defer, which, if set TRUE, converts the failures into defers for both kinds of timeout. A transport filter timeout is now identified in the log output. PH/46 The "scripts/Configure-config.h" script calls "make" at one point. On systems where "make" and "gmake" are different, calling "gmake" at top level broke things. I've arranged for the value of $(MAKE) to be passed from the Makefile to this script so that it can call the same version of "make". A note about Exim versions 4.44 and 4.50 ---------------------------------------- Exim 4.50 was meant to be the next release after 4.43. It contains a lot of changes of various kinds. As a consequence, a big documentation update was needed. This delayed the release for rather longer than seemed good, especially in the light of a couple of (minor) security issues. Therefore, the changes that fixed bugs were backported into 4.43, to create a 4.44 maintenance release. So 4.44 and 4.50 are in effect two different branches that both start from 4.43. I have left the 4.50 change log unchanged; it contains all the changes since 4.43. The change log for 4.44 is below; many of its items are identical to those for 4.50. This seems to be the most sensible way to preserve the historical information. Exim version 4.50 ----------------- 1. Minor wording change to the doc/README.SIEVE file. 2. Change 4.43/35 introduced a bug: if quota_filecount was set, the computation of the current number of files was incorrect. 3. Closing a stable door: arrange to panic-die if setitimer() ever fails. The bug fixed in 4.43/37 would have been diagnosed quickly if this had been in place. 4. Give more explanation in the error message when the command for a transport filter fails to execute. 5. There are several places where Exim runs a non-Exim command in a subprocess. The SIGUSR1 signal should be disabled for these processes. This was being done only for the command run by the queryprogram router. It is now done for all such subprocesses. The other cases are: ${run, transport filters, and the commands run by the lmtp and pipe transports. 6. Added CONFIGURE_GROUP build-time option. 7. Some older OS have a limit of 256 on the maximum number of file descriptors. Exim was using setrlimit() to set 1000 as a large value unlikely to be exceeded. Change 4.43/17 caused a lot of logging on these systems. I've change it so that if it can't get 1000, it tries for 256. 8. "control=submission" was allowed, but had no effect, in a DATA ACL. This was an oversight, and furthermore, ever since the addition of extra controls (e.g. 4.43/32), the checks on when to allow different forms of "control" were broken. There should now be diagnostics for all cases when a control that does not make sense is encountered. 9. Added the /retain_sender option to "control=submission". 10. $recipients is now available in the predata ACL (oversight). 11. Tidy the search cache before the fork to do a delivery from a message received from the command line. Otherwise the child will trigger a lookup failure and thereby defer the delivery if it tries to use (for example) a cached ldap connection that the parent has called unbind on. 12. If verify=recipient was followed by verify=sender in a RCPT ACL, the value of $address_data from the recipient verification was clobbered by the sender verification. 13. The value of address_data from a sender verification is now available in $sender_address_data in subsequent conditions in the ACL statement. 14. Added forbid_sieve_filter and forbid_exim_filter to the redirect router. 15. Added a new option "connect=