SOCKS: move from Experimental to mainline

diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 8b2bb4dab90c5f61fb2b861553653a1a12b0dc51..677b4ef508bdd05d8a54aecec49c927e357d08e2 100644 (file)
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -23729,6 +23729,14 @@ Alternatively, if the value of &%size_addition%& is set negative, it disables
 the use of the SIZE option altogether.
 
 
+.new
+.option socks_proxy smtp string&!! unset
+.cindex proxy SOCKS
+This option enables use of SOCKS proxies for connections made by the
+transport.  For details see &<<SECTproxySOCKS>>&.
+.wen
+
+
 .option tls_certificate smtp string&!! unset
 .cindex "TLS" "client certificate, location of"
 .cindex "certificate" "client, location of"
@@ -38008,6 +38016,83 @@ for more information of what they mean.
 . ////////////////////////////////////////////////////////////////////////////
 . ////////////////////////////////////////////////////////////////////////////
 
+.chapter "Proxies" "CHAPproxies" &&&
+         "Proxy support"
+.cindex "proxy support"
+.cindex "proxy" "access via"
+
+.new
+A proxy is an intermediate system through which communication is passed.
+Proxies may provide a security, availability or load-distribution function.
+
+.section "Outbound proxies" SECTproxySOCKS
+.cindex proxy outbound
+.cindex proxy "client side"
+.cindex proxy SOCKS
+.cindex SOCKS proxy
+Exim has support for sending outbound SMTP via a proxy
+using a protocol called SOCKS5 (defined by RFC1928).
+The support can be removed by defining DISABLE_SOCKS=yes in Local/Makefile.
+
+Use of a proxy is enabled by setting the &%socks_proxy%& on an smtp transport.
+The option value is expanded and should then be a list
+(colon-separated by default) of proxy specifiers.
+Each proxy specifier is a list
+(space-separated by default) where the initial element
+is an IP address and any subsequent elements are options.
+
+Options are a string <name>=<value>. 
+The list of options is in the following table:
+.display
+&`auth   `& authentication method
+&`name   `& authentication username
+&`pass   `& authentication password
+&`port   `& tcp port
+&`tmo    `& connection timeout
+&`pri    `& priority
+&`weight `& selection bias
+.endd
+
+More details on each of these options follows:
+
+.ilist
+.cindex authentication "to proxy"
+.cindex proxy authentication
+&%auth%&: Either &"none"& (default) or &"name"&.
+Using &"name"& selects username/password authentication per RFC 1929
+for access to the proxy.
+Default is &"none"&.
+.next
+&%name%&: sets the username for the &"name"& authentication method.
+Default is empty.
+.next
+&%pass%&: sets the password for the &"name"& authentication method.
+Default is empty.
+.next
+&%port%&: the TCP port number to use for the connection to the proxy.
+Default is 1080.
+.next
+&%tmo%&: sets a connection timeout in seconds for this proxy.
+Default is 5.
+.next
+&%pri%&: specifies a priority for the proxy within the list,
+higher values being tried first.
+The default priority is 1.
+.next
+&%weight%&: specifies a selection bias.
+Within a priority set servers are queried in a random fashion,
+weighted by this value.
+The default value for selection bias is 1.
+.endlist
+
+Proxies from the list are tried according to their priority
+and weight settings until one responds.  The timeout for the
+overall connection applies to the set of proxied attempts.
+.wen
+
+. ////////////////////////////////////////////////////////////////////////////
+. ////////////////////////////////////////////////////////////////////////////
+
 .chapter "Adding new drivers or lookup types" "CHID13" &&&
          "Adding drivers or lookups"
 .cindex "adding drivers"

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 20623997ffbf17d0ed1fb5b67413aeac77ef5af7..e78f49cf4ae778e71357e2e3b9cb733b3fbcd513 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -112,6 +112,9 @@ JH/21 Bug 1720: Add support for priority groups and weighted-random proxy
 JH/22 Bugs 963, 1721: Fix some corner cases in message body canonicalisation
       for DKIM processing.
 
+JH/23 Move SOCKS5 support from Experimental to mainline.  It can be left out
+      from a build by defining DISABLE_SOCKS.
+
 
 Exim version 4.86
 -----------------

diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index 18a5fd917d050b871e605bfa25b2af8eb2129254..f0f1035ea003850cc93df0f21782b3e698570789 100644 (file)
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -880,6 +880,9 @@ following will be forced:
 
 No other use is made of the result string.
 
+If transport proxying is used, the remote IP/port during a
+tcp:connect event will be that of the proxy.
+
 
 Known issues:
 - the tls:cert event is only called for the cert chain elements
@@ -1115,44 +1118,6 @@ QUIT
 
 
 
-SOCKS
-------------------------------------------------------------
-Support for proxying outbound SMTP via a Socks 5 proxy
-(RFC 1928) is included if Exim is compiled with
-EXPERIMENTAL_SOCKS defined.
-
-If an smtp transport has a nonempty socks_proxy option
-defined, this is active.  The option is expanded and
-should be a list (colon-separated by default) of
-proxy specifiers.  Each proxy specifier is a list
-(space-separated by default) where the initial element
-is an IP address and any subsequent elements are options.
-
-Options are a string <name>=<value>.
-These options are currently defined:
-- "auth", with possible values "none" and "name".
-  Using "name" selects username/password authentication
-  per RFC 1929. Default is "none".
-- "name" sets the authentication username. Default is empty.
-- "pass" sets the authentication password. Default is empty.
-- "port" sets the tcp port number for the proxy. Default is 1080.
-- "tmo" sets a connection timeout in seconds for this proxy. Default is 5.
-- "pri" specifies a priority for the server within the list, higher
-  values being tried first. The default priority is 1.
-- "weight" specifies a selection bias. Within a priority set servers
-  are queried in a random fashion, weighted by this value. The default
-  value for selection bias is 1.
-
-Proxies from the list are tried according to their priority
-and weight settings until one responds.  The timeout for the
-overall connection applies to the set of proxied attempts.
-
-If events are used, the remote IP/port during a
-tcp:connect event will be that of the proxy.
-
-
-
-
 DANE
 ------------------------------------------------------------
 DNS-based Authentication of Named Entities, as applied

diff --git a/src/src/EDITME b/src/src/EDITME
index c2d95ff40cc20773f7cd4312a831b19d9e56eadd..5b17e53d830ce3788fe1465987a871b0eaf06226 100644 (file)
--- a/src/src/EDITME
+++ b/src/src/EDITME
@@ -431,6 +431,13 @@ EXIM_MONITOR=eximon.bin
 # DISABLE_DNSSEC=yes
 
 
+#------------------------------------------------------------------------------
+# By default Exim has support for connecting outbound via a SOCK5 proxy.
+# To remove this support uncomment the following line.
+
+# DISABLE_SOCKS=yes
+
+
 #------------------------------------------------------------------------------
 # Compiling Exim with experimental features. These are documented in
 # experimental-spec.txt. "Experimental" means that the way these features are
@@ -497,9 +504,6 @@ EXIM_MONITOR=eximon.bin
 # Note: Enabling this unconditionally overrides DISABLE_DNSSEC
 # EXPERIMENTAL_DANE=yes
 
-# Uncomment the following line to add SOCKS support
-# EXPERIMENTAL_SOCKS=yes
-
 # Uncomment the following to add Internationalisation features. You need to
 # have the IDN library installed.
 # EXPERIMENTAL_INTERNATIONAL=yes

diff --git a/src/src/config.h.defaults b/src/src/config.h.defaults
index 6af3b4d4309899f1dda1e871df19ab80cbb86275..9ebb4f8dea2cb7772a631b1f6b68e32b11f1f6bd 100644 (file)
--- a/src/src/config.h.defaults
+++ b/src/src/config.h.defaults
@@ -41,10 +41,11 @@ it's a default value. */
 #define DEFAULT_CRYPT              crypt
 #define DELIVER_IN_BUFFER_SIZE     8192
 #define DELIVER_OUT_BUFFER_SIZE    8192
+#define DISABLE_DNSSEC
 #define DISABLE_DKIM
 #define DISABLE_PRDR
 #define DISABLE_OCSP
-#define DISABLE_DNSSEC
+#define DISABLE_SOCKS
 #define DISABLE_D_OPTION
 
 #define ENABLE_DISABLE_FSYNC
@@ -178,7 +179,6 @@ it's a default value. */
 #define EXPERIMENTAL_INTERNATIONAL
 #define EXPERIMENTAL_PROXY
 #define EXPERIMENTAL_REDIS
-#define EXPERIMENTAL_SOCKS
 #define EXPERIMENTAL_SPF
 #define EXPERIMENTAL_SRS
 

diff --git a/src/src/exim.c b/src/src/exim.c
index 27b73b764fb3fa1209f5f3ba79be114b56bb3725..a0477faa145439f3baad8fcda2e2390b2a4c2d55 100644 (file)
--- a/src/src/exim.c
+++ b/src/src/exim.c
@@ -814,20 +814,23 @@ fprintf(f, "Support for:");
 #ifdef WITH_CONTENT_SCAN
   fprintf(f, " Content_Scanning");
 #endif
-#ifndef DISABLE_DKIM
-  fprintf(f, " DKIM");
-#endif
 #ifdef WITH_OLD_DEMIME
   fprintf(f, " Old_Demime");
 #endif
+#ifndef DISABLE_DKIM
+  fprintf(f, " DKIM");
+#endif
 #ifndef DISABLE_DNSSEC
   fprintf(f, " DNSSEC");
 #endif
+#ifndef DISABLE_OCSP
+  fprintf(f, " OCSP");
+#endif
 #ifndef DISABLE_PRDR
   fprintf(f, " PRDR");
 #endif
-#ifndef DISABLE_OCSP
-  fprintf(f, " OCSP");
+#ifndef DISABLE_SOCKS
+  fprintf(f, " SOCKS");
 #endif
 #ifdef EXPERIMENTAL_SPF
   fprintf(f, " Experimental_SPF");
@@ -862,9 +865,6 @@ fprintf(f, "Support for:");
 #ifdef EXPERIMENTAL_REDIS
   fprintf(f, " Experimental_Redis");
 #endif
-#ifdef EXPERIMENTAL_SOCKS
-  fprintf(f, " Experimental_SOCKS");
-#endif
 fprintf(f, "\n");
 
 fprintf(f, "Lookups (built-in):");

diff --git a/src/src/smtp_out.c b/src/src/smtp_out.c
index d32ef89b5dae2e727724a6944b64444375b0b774..abc5b80feba6429a78a02eb6de5a05c2cd974924 100644 (file)
--- a/src/src/smtp_out.c
+++ b/src/src/smtp_out.c
@@ -267,7 +267,7 @@ int
 smtp_connect(host_item *host, int host_af, int port, uschar *interface,
   int timeout, transport_instance * tb)
 {
-#ifdef EXPERIMENTAL_SOCKS
+#ifndef DISABLE_SOCKS
 smtp_transport_options_block * ob =
   (smtp_transport_options_block *)tb->options_block;
 #endif
@@ -287,7 +287,7 @@ HDEBUG(D_transport|D_acl|D_v)
   {
   uschar * s = US" ";
   if (interface) s = string_sprintf(" from %s ", interface);
-#ifdef EXPERIMENTAL_SOCKS
+#ifndef DISABLE_SOCKS
   if (ob->socks_proxy) s = string_sprintf("%svia proxy ", s);
 #endif
   debug_printf("Connecting to %s %s%s... ", host->name, callout_address, s);
@@ -295,7 +295,7 @@ HDEBUG(D_transport|D_acl|D_v)
 
 /* Create and connect the socket */
 
-#ifdef EXPERIMENTAL_SOCKS
+#ifndef DISABLE_SOCKS
 if (ob->socks_proxy)
   return socks_sock_connect(host, host_af, port, interface, tb, timeout);
 #endif

diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index 66d632fad7803767b010a65ebea6484bef1bb802..fc1439e932299bc144e165a8370b172a56ff8363 100644 (file)
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -159,7 +159,7 @@ optionlist smtp_transport_options[] = {
       (void *)offsetof(smtp_transport_options_block, serialize_hosts) },
   { "size_addition",        opt_int,
       (void *)offsetof(smtp_transport_options_block, size_addition) }
-#ifdef EXPERIMENTAL_SOCKS
+#ifndef DISABLE_SOCKS
  ,{ "socks_proxy",          opt_stringptr,
       (void *)offsetof(smtp_transport_options_block, socks_proxy) }
 #endif
@@ -249,7 +249,7 @@ smtp_transport_options_block smtp_transport_option_defaults = {
   FALSE,               /* lmtp_ignore_quota */
   NULL,                       /* expand_retry_include_ip_address */
   TRUE                 /* retry_include_ip_address */
-#ifdef EXPERIMENTAL_SOCKS
+#ifndef DISABLE_SOCKS
  ,NULL                 /* socks_proxy */
 #endif
 #ifdef SUPPORT_TLS

diff --git a/src/src/transports/smtp.h b/src/src/transports/smtp.h
index 2aeab9add4441cc9bf065f5edf3f2ab569ac7581..c77c2c5d951445af3cefe34e3e881267ffa24252 100644 (file)
--- a/src/src/transports/smtp.h
+++ b/src/src/transports/smtp.h
@@ -59,7 +59,7 @@ typedef struct {
   BOOL    lmtp_ignore_quota;
   uschar *expand_retry_include_ip_address;
   BOOL    retry_include_ip_address;
-#ifdef EXPERIMENTAL_SOCKS
+#ifndef DISABLE_SOCKS
   uschar *socks_proxy;
 #endif
 #ifdef SUPPORT_TLS
@@ -111,7 +111,7 @@ extern int     smtp_auth(uschar *, unsigned, address_item *, host_item *,
 extern BOOL    smtp_mail_auth_str(uschar *, unsigned,
                 address_item *, smtp_transport_options_block *);
 
-#ifdef EXPERIMENTAL_SOCKS
+#ifndef DISABLE_SOCKS
 extern int     socks_sock_connect(host_item *, int, int, uschar *,
                 transport_instance *, int);
 #endif

diff --git a/src/src/transports/smtp_socks.c b/src/src/transports/smtp_socks.c
index 6d4e072eb4de1e351c3928850eaa2f969ba2f0be..a7d4e106f6918981ab0385d4ad32c809f274a413 100644 (file)
--- a/src/src/transports/smtp_socks.c
+++ b/src/src/transports/smtp_socks.c
@@ -10,7 +10,7 @@
 #include "../exim.h"
 #include "smtp.h"
 
-#ifdef EXPERIMENTAL_SOCKS      /* entire file */
+#ifndef DISABLE_SOCKS  /* entire file */
 
 #ifndef nelem
 # define nelem(arr) (sizeof(arr)/sizeof(*arr))

diff --git a/test/scripts/4020-socks/REQUIRES b/test/scripts/4020-socks/REQUIRES
index 135603c74a739ee30952b2dda889bd62e29d2626..5c6dbbad6cc6f37c49126cdf5fddffb74b917b7f 100644 (file)
--- a/test/scripts/4020-socks/REQUIRES
+++ b/test/scripts/4020-socks/REQUIRES
@@ -1 +1 @@
-support Experimental_SOCKS
+support SOCKS

diff --git a/test/scripts/4028-GnuTLS-socks/REQUIRES b/test/scripts/4028-GnuTLS-socks/REQUIRES
index 0b41941acb7cb7e6c47fb2ed7dbd26474039fa7f..5accf7bf34a6ccc5fe5d0b0fd4361911e809e1ad 100644 (file)
--- a/test/scripts/4028-GnuTLS-socks/REQUIRES
+++ b/test/scripts/4028-GnuTLS-socks/REQUIRES
@@ -1,4 +1,4 @@
-support Experimental_SOCKS
+support SOCKS
 support GnuTLS
 running IPv4
 running socks

diff --git a/test/scripts/4029-OpenSSL-socks/REQUIRES b/test/scripts/4029-OpenSSL-socks/REQUIRES
index b24bbd9a047ae85509e6b87c672a16b64ad96726..d42ca4cee72a99c41c5d354f17fee5c0b60586ba 100644 (file)
--- a/test/scripts/4029-OpenSSL-socks/REQUIRES
+++ b/test/scripts/4029-OpenSSL-socks/REQUIRES
@@ -1,4 +1,4 @@
-support Experimental_SOCKS
+support SOCKS
 support OpenSSL
 running IPv4
 running socks