exim.git
7 years agoShuffle test order
Jeremy Harris [Thu, 14 Aug 2014 19:47:31 +0000 (20:47 +0100)]
Shuffle test order

7 years agoAdd testcase for TLSA record access
Jeremy Harris [Thu, 14 Aug 2014 19:28:02 +0000 (20:28 +0100)]
Add testcase for TLSA record access

7 years agoFix non-dane build
Jeremy Harris [Thu, 14 Aug 2014 13:52:40 +0000 (14:52 +0100)]
Fix non-dane build

7 years agoEnable OCSP
Jeremy Harris [Sun, 10 Aug 2014 20:52:24 +0000 (21:52 +0100)]
Enable OCSP

7 years agoAdd (2 0 1) test
Jeremy Harris [Sun, 10 Aug 2014 18:06:47 +0000 (19:06 +0100)]
Add (2 0 1) test

7 years agoChange CV= log line element for dane-verified cert
Jeremy Harris [Sun, 10 Aug 2014 16:25:26 +0000 (17:25 +0100)]
Change CV= log line element for dane-verified cert

7 years agoCapture the knowlege that verification succeeded
Jeremy Harris [Sun, 10 Aug 2014 15:57:15 +0000 (16:57 +0100)]
Capture the knowlege that verification succeeded

7 years agoAdd direct-A test
Jeremy Harris [Sun, 10 Aug 2014 14:55:43 +0000 (15:55 +0100)]
Add direct-A test

7 years agoVerifiable conn with DANE-EE(3) / SPKI(1) / SHA2-512(2)
Jeremy Harris [Sun, 10 Aug 2014 14:00:27 +0000 (15:00 +0100)]
Verifiable conn with DANE-EE(3) / SPKI(1) / SHA2-512(2)

7 years agoDiffs for draft 11
Jeremy Harris [Sun, 10 Aug 2014 13:58:59 +0000 (14:58 +0100)]
Diffs for draft 11

7 years agoCopy latest SMTP-with-DANE - draft 11
Jeremy Harris [Sun, 10 Aug 2014 13:43:59 +0000 (14:43 +0100)]
Copy latest SMTP-with-DANE - draft 11

7 years agoAdd support in the fakens utility for TLSA records
Jeremy Harris [Sun, 10 Aug 2014 11:31:21 +0000 (12:31 +0100)]
Add support in the fakens utility for TLSA records

7 years agoAdd support in the fakens utility for marking records as "secure"
Jeremy Harris [Sun, 10 Aug 2014 10:58:06 +0000 (11:58 +0100)]
Add support in the fakens utility for marking records as "secure"
and returning an AD bit for lookups.

7 years agoOn a host lookup name->MX->A->ip sequence, require both stages to
Jeremy Harris [Sun, 10 Aug 2014 10:49:49 +0000 (11:49 +0100)]
On a host lookup name->MX->A->ip sequence, require both stages to
be dnssec before declaring the lookup was secure.

7 years agoIgnore dane-related debug out in non-dane testcases
Jeremy Harris [Sat, 9 Aug 2014 15:04:37 +0000 (16:04 +0100)]
Ignore dane-related debug out in non-dane testcases

7 years agoTest development
Jeremy Harris [Fri, 8 Aug 2014 20:37:22 +0000 (21:37 +0100)]
Test development

7 years agoTestsuite basics.
Jeremy Harris [Fri, 8 Aug 2014 19:45:24 +0000 (20:45 +0100)]
Testsuite basics.

Not actually excercising DANE yet,
this will take additions in the fakedns and
probably changes in certificates.

7 years agoSketch in library interface
Jeremy Harris [Thu, 7 Aug 2014 21:18:41 +0000 (22:18 +0100)]
Sketch in library interface

7 years agoGeneral discussion of DANE usage
Jeremy Harris [Thu, 7 Aug 2014 19:31:46 +0000 (20:31 +0100)]
General discussion of DANE usage

7 years agoFix development-testing induced crash on second use
Jeremy Harris [Fri, 1 Aug 2014 18:07:56 +0000 (19:07 +0100)]
Fix development-testing induced crash on second use

7 years agoBasic DANE entry points
Jeremy Harris [Fri, 1 Aug 2014 17:16:53 +0000 (18:16 +0100)]
Basic DANE entry points

7 years agoAdd interface documentation for the DANE library
Jeremy Harris [Thu, 31 Jul 2014 20:52:48 +0000 (21:52 +0100)]
Add interface documentation for the DANE library

7 years agoCoding style closer to project norms
Jeremy Harris [Tue, 29 Jul 2014 21:27:42 +0000 (22:27 +0100)]
Coding style closer to project norms

7 years agoAdd DANE RFC (6698) for reference
Todd Lyons [Tue, 29 Jul 2014 15:40:38 +0000 (08:40 -0700)]
Add DANE RFC (6698) for reference

7 years agoAdd current draft of SMTP with DANE
Todd Lyons [Tue, 29 Jul 2014 14:33:26 +0000 (07:33 -0700)]
Add current draft of SMTP with DANE

7 years agoCreate a hosts_try_dane transport option, does nothing yet
Todd Lyons [Mon, 24 Mar 2014 18:24:23 +0000 (11:24 -0700)]
Create a hosts_try_dane transport option, does nothing yet

7 years agoFramework to build dane support
Todd Lyons [Wed, 5 Mar 2014 14:17:54 +0000 (06:17 -0800)]
Framework to build dane support

7 years agoFix doc parse error
Todd Lyons [Tue, 29 Jul 2014 12:24:50 +0000 (05:24 -0700)]
Fix doc parse error

7 years agoDocument acl args variables in main variables section
Jeremy Harris [Sat, 26 Jul 2014 13:28:40 +0000 (14:28 +0100)]
Document acl args variables in main variables section

7 years agoFix "default config" section wrt. rfc1413_hosts
Jeremy Harris [Thu, 24 Jul 2014 12:55:00 +0000 (13:55 +0100)]
Fix "default config" section wrt. rfc1413_hosts

7 years agoBug 1506: document change made
Todd Lyons [Wed, 23 Jul 2014 15:11:09 +0000 (08:11 -0700)]
Bug 1506: document change made

7 years agoBug 1506: Silence static checkers.
Lars Mueller [Wed, 23 Jul 2014 14:22:52 +0000 (07:22 -0700)]
Bug 1506: Silence static checkers.

Re-adds a return NULL which was removed because it was redundant. Static
  checkers don't parse the logic, so adding it back to make them happy.

7 years agoBug 1506: Fix static typechecker output
Todd Lyons [Wed, 23 Jul 2014 14:09:06 +0000 (07:09 -0700)]
Bug 1506: Fix static typechecker output

The end of the function can never be reached because the switch is only
  reached if the value it is checking is valid. Putting this return
  silences the warnings.

7 years agoUpdate version numbers, clean docs for next release
Todd Lyons [Wed, 23 Jul 2014 14:08:52 +0000 (07:08 -0700)]
Update version numbers, clean docs for next release

7 years agoMassage coding style to project norm
Jeremy Harris [Tue, 22 Jul 2014 21:30:22 +0000 (22:30 +0100)]
Massage coding style to project norm

7 years agoDocumentation/Tests for CVE-2014-2972 fix exim-4_83
Todd Lyons [Fri, 18 Jul 2014 18:42:08 +0000 (11:42 -0700)]
Documentation/Tests for CVE-2014-2972 fix

7 years agoOnly expand integers for integer math once
Tony Finch [Wed, 16 Jul 2014 13:13:39 +0000 (06:13 -0700)]
Only expand integers for integer math once

7 years agoFix regex for Suse when converting spec to ASCII
Todd Lyons [Tue, 15 Jul 2014 19:50:35 +0000 (12:50 -0700)]
Fix regex for Suse when converting spec to ASCII

7 years agoFix parsing of mime headers
Jeremy Harris [Mon, 14 Jul 2014 13:13:22 +0000 (14:13 +0100)]
Fix parsing of mime headers

RFC2045 allows parameter values to be quoted; an embedded semicolon
must then not terminate the parameter.

7 years agoDNSSEC: fix clang warning re && in || precedence
Phil Pennock [Mon, 14 Jul 2014 07:13:13 +0000 (03:13 -0400)]
DNSSEC: fix clang warning re && in || precedence

I looked and AFAICT the compiler guidance gives the correct logical
binding for the code intention.

```
dnsdb.c:362:32: warning: '&&' within '||' [-Wlogical-op-parentheses]
       || dnssec_mode == DEFER && !dns_is_secure(&dnsa)
       ~~ ~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~
dnsdb.c:362:32: note: place parentheses around the '&&' expression to silence this warning
       || dnssec_mode == DEFER && !dns_is_secure(&dnsa)
                               ^
          (                                            )
```

7 years agoMacOS: fix clang redef warning
Phil Pennock [Mon, 14 Jul 2014 07:10:41 +0000 (03:10 -0400)]
MacOS: fix clang redef warning

7 years agoUse Ustrlen() on a uschar
Phil Pennock [Mon, 14 Jul 2014 07:04:16 +0000 (03:04 -0400)]
Use Ustrlen() on a uschar

7 years agoFix unsigned < 0 check
Phil Pennock [Mon, 14 Jul 2014 06:59:52 +0000 (02:59 -0400)]
Fix unsigned < 0 check

Two places in malware.c were using `fsize`, defined as `unsigned int`,
to receive the result of `lseek()` and then checking if the value was
less than 0.  As clang says:

```
malware.c:1228:46: warning: comparison of unsigned expression < 0 is always false [-Wtautological-compare]
          if ((fsize = lseek(clam_fd, 0, SEEK_END)) < 0) {
              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~
```

Fix.  Use `off_t`, which we're already using elsewhere, then use
`fsize_uint` to handle off_t being potentially 64-bit, and a
sanity-check on conversion which hopefully won't be optimised away by
compilers.

7 years agoRename T_APL to T_ADDRESSES
Phil Pennock [Mon, 14 Jul 2014 06:49:33 +0000 (02:49 -0400)]
Rename T_APL to T_ADDRESSES

Fixes Github issue #15

Known DNS RRTYPE aliases can be found at
<http://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml>
and `T_APL` conflicts with the `APL` RRTYPE, Address Prefix List, in
experimental RFC 3123.

Issue reported compilation issues on OpenBSD.

Instead, use `T_ADDRESSES`.

7 years agoFix TLS SNI, and add regression test cases
Jeremy Harris [Sun, 13 Jul 2014 11:18:09 +0000 (12:18 +0100)]
Fix TLS SNI, and add regression test cases

7 years agoReinstate SNI variables under GnuTLS. Bug 1499 exim-4_83_RC3
Jeremy Harris [Tue, 8 Jul 2014 12:54:53 +0000 (13:54 +0100)]
Reinstate SNI variables under GnuTLS.  Bug 1499

7 years agoTypo in docs, add missing word
Todd Lyons [Thu, 3 Jul 2014 17:29:50 +0000 (10:29 -0700)]
Typo in docs, add missing word

7 years agoAdd cscope files to git ignore list
Todd Lyons [Thu, 3 Jul 2014 17:23:18 +0000 (10:23 -0700)]
Add cscope files to git ignore list

7 years agoEnhance documentation of ${run command parsing.
Todd Lyons [Thu, 3 Jul 2014 15:32:48 +0000 (08:32 -0700)]
Enhance documentation of ${run command parsing.

7 years agoBug 1496: Fix typo in ChangeLog
Todd Lyons [Wed, 2 Jul 2014 14:04:38 +0000 (07:04 -0700)]
Bug 1496: Fix typo in ChangeLog

7 years agoBug 1495: Exiqgrep -C check configfile readability
Andrew Colin Kissa [Wed, 2 Jul 2014 14:00:46 +0000 (07:00 -0700)]
Bug 1495: Exiqgrep -C check configfile readability

7 years agoUse enum for var_entry type
Jeremy Harris [Fri, 20 Jun 2014 12:40:24 +0000 (13:40 +0100)]
Use enum for var_entry type

7 years agoFix build dependencies
Heiko Schlittermann [Tue, 17 Jun 2014 11:18:26 +0000 (12:18 +0100)]
Fix build dependencies

"make distclean; make -j" was failing on config.h

7 years agoCorrect testuite doc
Jeremy Harris [Sun, 15 Jun 2014 15:44:56 +0000 (16:44 +0100)]
Correct testuite doc

7 years agoFix testcase 0390 when testing an EXPERIMENTAL_TPDA compile
Jeremy Harris [Sun, 15 Jun 2014 15:16:32 +0000 (16:16 +0100)]
Fix testcase 0390 when testing an EXPERIMENTAL_TPDA compile

Insert a custom-munge for the new transport option.
This may be removed once the code goes mainline.

7 years agoFix testcase 0373
Jeremy Harris [Sun, 15 Jun 2014 14:48:55 +0000 (15:48 +0100)]
Fix testcase 0373

A readsocket expansion against a unix-domain socket which is
immediately closed.  This gave variable results does to the race of
the write into the client-end versus the close at the server end.
Insert under-testsuite delays to assure sequencing; the testcase
now specifically looks for a write into a closed peer.

7 years agoFix dkim for no-key case under SENDFILE compile. Bug 934
Wolfgang Breyha [Wed, 11 Jun 2014 18:19:49 +0000 (19:19 +0100)]
Fix dkim for no-key case under SENDFILE compile.  Bug 934

Tested-by: <wbreyha@gmx.net>
7 years agoTidy coding style. Bug 934
Jeremy Harris [Wed, 11 Jun 2014 18:17:28 +0000 (19:17 +0100)]
Tidy coding style.  Bug 934

7 years agoUse strict C89 variable declaration positioning
Jeremy Harris [Sun, 8 Jun 2014 20:31:47 +0000 (21:31 +0100)]
Use strict C89 variable declaration positioning

7 years agoPreempt future testsuite integration of EXPERIMENTAL_DSN
Jeremy Harris [Sun, 8 Jun 2014 20:13:07 +0000 (21:13 +0100)]
Preempt future testsuite integration of EXPERIMENTAL_DSN

7 years agoFix testcase for today's faster cpus
Jeremy Harris [Sun, 8 Jun 2014 20:08:31 +0000 (21:08 +0100)]
Fix testcase for today's faster cpus

7 years agoTestcase for udpsend
Jeremy Harris [Sun, 8 Jun 2014 16:49:21 +0000 (17:49 +0100)]
Testcase for udpsend

7 years agoInitial set of warnings for the upcoming release
Jeremy Harris [Fri, 6 Jun 2014 19:17:51 +0000 (20:17 +0100)]
Initial set of warnings for the upcoming release

7 years agoFix testcase for 984702 - the buffer boundary was deliberately
Jeremy Harris [Fri, 6 Jun 2014 16:53:08 +0000 (17:53 +0100)]
Fix testcase for 984702 - the buffer boundary was deliberately
being explored by the test

7 years agoMore care with time types
Jeremy Harris [Fri, 6 Jun 2014 14:58:54 +0000 (15:58 +0100)]
More care with time types

7 years agoFix udpsend and ip_connectedsocket(). exim-4_83_RC2
Tony Finch [Thu, 5 Jun 2014 17:01:11 +0000 (18:01 +0100)]
Fix udpsend and ip_connectedsocket().

The ip_connectedsocket() function's socket type support and error
reporting did not work properly.

7 years agoTidy up OpenSSL certificate signature & sig_algorithm extractor results.
Jeremy Harris [Thu, 5 Jun 2014 14:16:29 +0000 (15:16 +0100)]
Tidy up OpenSSL certificate signature & sig_algorithm extractor results.
Bug 1489

7 years agoCompiler quietening
Jeremy Harris [Wed, 4 Jun 2014 19:11:25 +0000 (20:11 +0100)]
Compiler quietening

7 years agoEnsure output buffer big enough for DSN additions to MAIL FROM. Bug 1482
Jeremy Harris [Mon, 26 May 2014 15:07:33 +0000 (16:07 +0100)]
Ensure output buffer big enough for DSN additions to MAIL FROM.  Bug 1482

7 years agoFix tiny ChangeLog typo
Todd Lyons [Mon, 2 Jun 2014 12:54:39 +0000 (05:54 -0700)]
Fix tiny ChangeLog typo

7 years agoSupport service names for tls_on_connect_ports. Bug 72
Jeremy Harris [Sat, 31 May 2014 14:36:13 +0000 (15:36 +0100)]
Support service names for tls_on_connect_ports.  Bug 72

7 years agoFix doc for $sender_host_dnssec. Bug 1485
Jeremy Harris [Fri, 30 May 2014 13:23:12 +0000 (14:23 +0100)]
Fix doc for $sender_host_dnssec. Bug 1485

7 years agoFix no-ssl build
Jeremy Harris [Fri, 30 May 2014 11:58:26 +0000 (12:58 +0100)]
Fix no-ssl build

7 years agoFix delivery $host in client authenticator in verify/callout. Bug 1476
Jeremy Harris [Thu, 29 May 2014 21:46:48 +0000 (22:46 +0100)]
Fix delivery $host in client authenticator in verify/callout.  Bug 1476

7 years agoLog warnings on presence of deperecated options
Jeremy Harris [Thu, 29 May 2014 20:57:04 +0000 (21:57 +0100)]
Log warnings on presence of deperecated options

7 years agoFix dnssec dnsdb lookup in defer_never mode
Jeremy Harris [Thu, 29 May 2014 20:00:04 +0000 (21:00 +0100)]
Fix dnssec dnsdb lookup in defer_never mode

7 years agoBug 1444: Fix \r\n handling writing spool file
Todd Lyons [Wed, 28 May 2014 15:48:45 +0000 (08:48 -0700)]
Bug 1444: Fix \r\n handling writing spool file

Fix a bug which causes DKIM signatures to fail because what gets
  written to the spool file is different than what gets passed through
  the DKIM code.

7 years agoMerge tag 'exim-4_82_1' exim-4_83_RC1
Todd Lyons [Wed, 28 May 2014 12:12:00 +0000 (05:12 -0700)]
Merge tag 'exim-4_82_1'

Fix Conflicts:
src/src/dmarc.c

7 years agoSECURITY: DMARC uses From header untrusted data exim-4_82_1
Todd Lyons [Mon, 26 May 2014 19:14:16 +0000 (12:14 -0700)]
SECURITY: DMARC uses From header untrusted data

CVE-2014-2957

To find the sending domain, expand_string() was used to directly parse
  the contents of the From header. This passes untrusted data directly
  into an internal function. Convert to use standard internal parsing
  functions.

7 years agoIncrease limit of smtp_confirmation logging from 100 to 256 chars. Bug 1408
Jeremy Harris [Mon, 26 May 2014 15:26:58 +0000 (16:26 +0100)]
Increase limit of smtp_confirmation logging from 100 to 256 chars.  Bug 1408

7 years agoErrorcheck TLS library calls
Jeremy Harris [Mon, 26 May 2014 10:47:30 +0000 (11:47 +0100)]
Errorcheck TLS library calls

7 years agoRestrict certificate name checkin for wildcards.
Jeremy Harris [Mon, 26 May 2014 09:35:50 +0000 (10:35 +0100)]
Restrict certificate name checkin for wildcards.

On more recent OpenSSL library versions the builtin wildcard checking
can take a restriction option that we want, to disallow the more
complex possibilities of wildcarding.

7 years agoMissing initialiser
Jeremy Harris [Sun, 25 May 2014 12:21:39 +0000 (13:21 +0100)]
Missing initialiser

7 years agoAdd OpenSSL version check
Jeremy Harris [Fri, 23 May 2014 17:46:03 +0000 (18:46 +0100)]
Add OpenSSL version check

7 years agoAdd GnuTLS version check
Jeremy Harris [Fri, 23 May 2014 17:32:48 +0000 (18:32 +0100)]
Add GnuTLS version check

7 years agoMove OCSP out of EXPERIMENTAL
Jeremy Harris [Fri, 23 May 2014 14:50:07 +0000 (15:50 +0100)]
Move OCSP out of EXPERIMENTAL

7 years agoCompiler quietening. Bug 907
Jeremy Harris [Thu, 22 May 2014 20:50:27 +0000 (21:50 +0100)]
Compiler quietening.  Bug 907

7 years agoBug 1394: Document how to do per host conn limits
Todd Lyons [Thu, 22 May 2014 20:24:42 +0000 (13:24 -0700)]
Bug 1394: Document how to do per host conn limits

Since the max connections per host setting is computed and enforced
  in the master listening process before the fork, there is no easy
  way to get an accurate connection count once the Proxy Protocol
  negotiation has been done (i.e. in a child process, after the
  fork). Rather than try to use a shared mmap file using CAS in the
  children to manipulate it, we just advise of a crude version of
  max connections per IP be achieved by using ratelimit per_conn in
  the connect ACL.

7 years agoFix doc for dovecot authenticator. Bugs 1448, 1483
Jeremy Harris [Thu, 22 May 2014 15:22:53 +0000 (16:22 +0100)]
Fix doc for dovecot authenticator.  Bugs 1448, 1483

7 years agoRFC3461 support - MIME DSN messages. Bug 118
Wolfgang Breyha [Wed, 21 May 2014 15:21:46 +0000 (16:21 +0100)]
RFC3461 support - MIME DSN messages.    Bug 118

7 years agoEliminate one foolish way to break the build
Jeremy Harris [Tue, 20 May 2014 21:53:48 +0000 (22:53 +0100)]
Eliminate one foolish way to break the build

7 years agoAdd PRDR feature output in -bV
Todd Lyons [Wed, 21 May 2014 14:03:29 +0000 (07:03 -0700)]
Add PRDR feature output in -bV

7 years agoSupport optional server certificate name checking. Bug 1479
Jeremy Harris [Tue, 20 May 2014 20:25:10 +0000 (21:25 +0100)]
Support optional server certificate name checking.  Bug 1479
Enable EXPERIMENTAL_CERTNAMES to include.

7 years agoFinal tidyout of EXPERIMENTAL_PRDR
Jeremy Harris [Tue, 20 May 2014 20:21:11 +0000 (21:21 +0100)]
Final tidyout of EXPERIMENTAL_PRDR

8 years agoUse accessor functions for OpenSSL internal data
Jeremy Harris [Sat, 17 May 2014 22:43:23 +0000 (23:43 +0100)]
Use accessor functions for OpenSSL internal data

8 years agoGeneral tidying
Jeremy Harris [Tue, 13 May 2014 11:27:04 +0000 (12:27 +0100)]
General tidying

8 years agoTidy certificate verification logic under OpenSSL
Jeremy Harris [Thu, 15 May 2014 23:07:31 +0000 (00:07 +0100)]
Tidy certificate verification logic under OpenSSL

8 years agoExtractors for certificate time fields support integer output modifier
Jeremy Harris [Tue, 13 May 2014 22:50:13 +0000 (23:50 +0100)]
Extractors for certificate time fields support integer output modifier

8 years agoExtractor for named RDN element types from a certificate DN field.
Jeremy Harris [Tue, 13 May 2014 21:02:51 +0000 (22:02 +0100)]
Extractor for named RDN element types from a certificate DN field.

8 years agoUpdated changelog.
Todd Lyons [Tue, 13 May 2014 18:36:35 +0000 (11:36 -0700)]
Updated changelog.

Accidentally included the fix for Bug 1119 in the same commit fixing
  Proxy Protocol version 2 to match the API change in May 2014.