Add new ALLOW_SYSTEM_CRYPT_BRACES build option

FreeBSD now defaults to a {sha512} hash prefix.  Rather than continue
adding more types to crypteq{}{}, to have the same options available
everywhere, we allow this build option to cause the comparison to fall
through to the system crypt() for unrecognised {...} prefices -- the
same logic that happens if the crypt doesn't have a {...} prefix.

Set ALLOW_SYSTEM_CRYPT_BRACES in FreeBSD's OS Makefile.

The `expand.c` change was tested in a `#if 0` variant by Randy Bush, who
confirms that this works.  The rest is Exim build tuning and
documentation thereof, "too simple to go wrong".  *cough*

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index e41dc3e02d7a3fdc4306f23b4e6ee5d698c169e8..8a277375993bca9815082859dcdf971672fe155e 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -82,6 +82,11 @@ TL/07 Add new dmarc expansion variable $dmarc_domain_policy to directly
       is a combined value of both the record presence and the result of the
       analysis.
 
+PP/02 Add new ALLOW_SYSTEM_CRYPT_BRACES option, enable by default for FreeBSD,
+      letting crypteq comparisons pass unrecognised {..} prefices through to
+      system crypt.
+
+
 Exim version 4.82
 -----------------
 

diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index c168cf2a781cc09b5ba3ce83b44e33cef7a235e7..07c8c3285145fc299335398c61c5167ff73072ae 100644 (file)
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -32,6 +32,13 @@ Version 4.83
     is split from the encryption operation. The default remains that a failed
     verification cancels the encryption.
 
+ 6. If your system's crypt() supports {hashtype} prefices unknown to Exim,
+    ensure that the compile-time "ALLOW_SYSTEM_CRYPT_BRACES" is defined (it
+    might be by default for your OS).  Without this, Exim rejects unrecognised
+    hashtypes, as it always has.  With this, the default handling passes the
+    value onto the system crypt().  This is necessary for FreeBSD {sha512}
+    support.
+
 
 Version 4.82
 ------------

diff --git a/doc/doc-txt/OptionLists.txt b/doc/doc-txt/OptionLists.txt
index 4ad112180f84101a22060928a7f2bb76b0604229..e8215d14d7976750bccf3ea4acf2dbe5d29c78d6 100644 (file)
--- a/doc/doc-txt/OptionLists.txt
+++ b/doc/doc-txt/OptionLists.txt
@@ -815,6 +815,7 @@ only listed below for the TLS implementation cases.
 Option                       Type         Description
 ------------------------------------------------------------------------------
 
+ALLOW_SYSTEM_CRYPT_BRACES    system**     system crypt() can handle {hashtype}
 ALT_CONFIG_PREFIX            optional     restricts location of -C files
 APPENDFILE_MODE              optional*
 APPENDFILE_DIRECTORY_MODE    optional*

diff --git a/src/OS/Makefile-FreeBSD b/src/OS/Makefile-FreeBSD
index ebb116bf2af5b8d6c1960d1bdcc328700bb5380e..ab09183663b3abc0bc92dbb187da94df4d0b3af3 100644 (file)
--- a/src/OS/Makefile-FreeBSD
+++ b/src/OS/Makefile-FreeBSD
@@ -8,6 +8,9 @@ CHMOD_COMMAND=/bin/chmod
 
 HAVE_SA_LEN=YES
 
+# FreeBSD has switched to {sha512} as the default hash-type.
+ALLOW_SYSTEM_CRYPT_BRACES=YES
+
 # crypt() is in a separate library
 LIBS=-lcrypt -lm -lutil
 

diff --git a/src/src/config.h.defaults b/src/src/config.h.defaults
index 962b90d6823cc8ac55b74c06def2f7340accfe2f..6b2bec047267dd28a29340e38839e782e601e6fb 100644 (file)
--- a/src/src/config.h.defaults
+++ b/src/src/config.h.defaults
@@ -13,6 +13,8 @@ it's a default value. */
 #define ALT_CONFIG_PREFIX
 #define TRUSTED_CONFIG_LIST
 
+#define ALLOW_SYSTEM_CRYPT_BRACES
+
 #define APPENDFILE_MODE            0600
 #define APPENDFILE_DIRECTORY_MODE  0700
 #define APPENDFILE_LOCKFILE_MODE   0600

diff --git a/src/src/expand.c b/src/src/expand.c
index d2ac8ca79116baa8b834b8c5432da666f2be6e27..afe60efc3a631b6f20db8d4550671c27241ad89a 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -2616,12 +2616,14 @@ switch(cond_type)
         sub[1] += 9;
         which = 2;
         }
+#ifndef ALLOW_SYSTEM_CRYPT_BRACES
       else if (sub[1][0] == '{')               /* }-for-text-editors */
         {
         expand_string_message = string_sprintf("unknown encryption mechanism "
           "in \"%s\"", sub[1]);
         return NULL;
         }
+#endif
 
       switch(which)
         {