affect Exim's operation, with an unchanged configuration file. For new
options, and new features, see the NewStuff file next to this ChangeLog.
+Exim version 4.95
+-----------------
+
+JH/01 Move the wait-for-next-tick (needed for unique messmage IDs) from
+ after reception to before a subsequent reception. This should
+ mean slightly faster delivery, and also confirmation of reception
+ to senders.
+
+JH/02 Move from using the pcre library to pcre2. The former is no longer
+ being developed or supported (by the original developer).
+
+JH/03 Constification work in the filters module required a major version
+ bump for the local-scan API. Specifically, the "headers_charset"
+ global which is visible via the API is now const and may therefore
+ not be modified by local-scan code.
+
+JH/04 Fix ClamAV TCP use under FreeBSD. Previously the OS-specific shim for
+ sendfile() didi not account for the way the ClamAV driver code called it.
+
+JH/05 Bug 2819: speed up command-line messages being read in. Previously a
+ time check was being done for every character; replace that with one
+ per buffer.
+
+JH/06 Bug 2815: Fix ALPN sent by server under OpenSSL. Previously the string
+ sent was prefixed with a length byte.
+
+JH/07 Change the SMTP feature name for pipelining connect to be compliant with
+ RFC 5321. Previously Dovecot (at least) would log errors during
+ submission.
+
+JH/08 Remove stripping of the binaries from the FreeBSD build. This was added
+ in 4.61 without a reason logged. Binaries will be bigger, which might
+ matter on diskspace-constrained systems, but debug is easier.
+
+JH/09 Fix macro-definition during "-be" expansion testing. The move to
+ write-protected store for macros had not accounted for these runtime
+ additions; fix by removing this protection for "-be" mode.
+
+JH/10 Convert all uses of select() to poll(). FreeBSD 12.2 was found to be
+ handing out large-numbered file descriptors, violating the usual Unix
+ assumption (and required by Posix) that the lowest possible number will be
+ allocated by the kernel when a new one is needed. In the daemon, and any
+ child procesees, values higher than 1024 (being bigger than FD_SETSIZE)
+ are not useable for FD_SET() [and hence select()] and overwrite the stack.
+ Assorted crashes happen.
+
+JH/11 Fix use of $sender_host_name in daemon process. When used in certain
+ main-section options or in a connect ACL, the value from the first ever
+ connection was never replaced for subsequent connections. Found by
+ Wakko Warner.
+
+JH/12 Bug 2838: Fix for i32lp64 hard-align platforms. Found for SPARC Linux,
+ though only once PCRE2 was introduced: the memory accounting used under
+ debug offset allocations by an int, giving a hard trap in early startup.
+ Change to using a size_t. Debug and fix by John Paul Adrian Glaubitz.
+
+JH/13 Bug 2845: Fix handling of tls_require_ciphers for OpenSSL when a value
+ with underbars is given. The write-protection of configuration introduced
+ in 4.95 trapped when normalisation was applied to an option not needing
+ expansion action.
+
+JH/14 Bug 1895: TLS: Deprecate RFC 5114 Diffie-Hellman parameters.
+
+JH/15 Fix a resource leak in *BSD. An off-by-one error resulted in the daemon
+ failing to close the certificates directory, every hour or any time it
+ was touched.
+
+JH/16 Debugging initiated by an ACL control now continues through into routing
+ and transport processes, when delivery is immediate. Previously debugging
+ stopped any time Exim re-execs.
+
+JH/17 The "expand" debug selector now gives more detail, specifically on the
+ result of expansion operators and items.
+
+
+Exim version 4.95
+-----------------
+
+JH/01 Bug 1329: Fix format of Maildir-format filenames to match other mail-
+ related applications. Previously an "H" was used where available info
+ says that "M" should be, so change to match.
+
+JH/02 Bug 2587: Fix pam expansion condition. Tainted values are commonly used
+ as arguments, so an implementation trying to copy these into a local
+ buffer was taking a taint-enforcement trap. Fix by using dynamically
+ created buffers. Similar fix for radius expansion condition.
+
+JH/03 Bug 2586: Fix listcount expansion operator. Using tainted arguments is
+ reasonable, eg. to count headers. Fix by using dynamically created
+ buffers rather than a local. Do similar fixes for ACL actions "dcc",
+ "log_reject_target", "malware" and "spam"; the arguments are expanded
+ so could be handling tainted values.
+
+JH/04 Bug 2590: Fix -bi (newaliases). A previous code rearrangement had
+ broken the (no-op) support for this sendmail command. Restore it
+ to doing nothing, silently, and returning good status.
+
+JH/05 Bug 2593: Fix "vacation" in Exim filter. Previously, when a "once"
+ record path was given (or the default used) without a leading directory
+ path, an error occurred on trying to open it. Use the transport's working
+ directory.
+
+JH/06 Bug 2594: Change the name used for certificate name checks in the smtp
+ transport. Previously it was the name on the DNS A-record; use instead
+ the head of the CNAME chain leading there (if there is one). This seems
+ to align better with RFC 6125.
+
+JH/07 Bug 2597: Fix a resource leak. Using a lookup in obtaining a value for
+ smtp_accept_max_per_host allocated resources which were not released
+ when the limit was exceeded. This eventually crashed the daemon. Fix
+ by adding a release action in that path.
+
+JH/08 Bug 2598: Fix verify ACL condition. The options for the condition are
+ expanded; previously using tainted values was rejected. Fix by using
+ dynamically-created buffers.
+
+JH/09 Relax restrictions on ACL verify condition needing access to message
+ headers. Previously they were only permitted in data and non-smtp ACLs;
+ permit also mime, dkim, prdr quit and notquit. Applies to header-syntax,
+ not_blind, header_sender and header_names_ascii verification.
+
+JH/10 Bug 2603: Fix coding of string copying to only evaluate arguments once.
+ Previously a macro used one argument twice; when called with the
+ argument as an expression having side-effects, incorrect operation
+ resulted. Use an inlineable function.
+
+JH/11 Bug 2604: Fix request to cutthrough-deliver when a connection is already
+ held open for a verify callout. Previously this wan not accounted for
+ and a corrupt onward SMTP conversation resulted.
+
+JH/12 Bug 2607: Fix the ${srs_encode } expansion to handle quoted local_parts.
+ Previously they were embedded naively in the constructed address; when
+ needed, strip the quoting and quote the entire local_part.
+ Also make the inbound_srs expansion condition handle quoting.
+
+JH/13 Fix dsearch "subdir" filter to ignore ".". Previously only ".." was
+ excluded, not matching the documentation.
+
+JH/14 Bug 2606: Fix a segfault in sqlite lookups. When no, or a bad, filename
+ was given for the sqlite_dbfile a trap resulted.
+
+JH/15 Bug 2620: Fix "spam" ACL condition. Previously, tainted values for the
+ "name" argument resulted in a trap. There is no reason to disallow such;
+ this was a coding error.
+
+JH/16 Bug 2615: Fix pause during message reception, on systems that have been
+ suspended/resumed. The Linux CLOCK_MONOTONIC does not account for time
+ spent suspended, ignoring the POSIX definition. Previously we assumed
+ it did and a constant offset from real time could be used as a correction.
+ Change to using the same clock source for the start-of-message and the
+ post-message next-tick-wait. Also change to using CLOCK_BOOTTIME if it
+ exists, just to get a clock slightly more aligned to reality.
+
+JH/17 Bug 2295: Fix DKIM signing to always semicolon-terminate. Although the
+ RFC says it is optional some validators care. The missing char was not
+ intended but triggered by a line-wrap alignment. Discovery and fix by
+ Guillaume Outters, hacked on by JH.
+
+JH/18 Bug 2617: Fix a taint trap in parse_fix_phrase(). Previously when the
+ name being quoted was tainted a trap would be taken. Fix by using
+ dynamically created buffers. The routine could have been called by a
+ rewrite with the "h" flag, by using the "-F" command-line option, or
+ by using a "name=" option on a control=submission ACL modifier.
+
+JH/19 SPF: change the Authentication-Results expansion component to give
+ smtp.helo when the sender domain is empty. Previously it gave
+ "smtp.mailfrom=<>"
+
+JH/20 Bug 2631: ACL dnslist conditions now ignore and log any lookups returns
+ not in 127.0.0.0/8 to help in spotting list domains taken over by a
+ domain-parking registrar.
+
+JH/21 Bug 2630: Fix eol-replacement string for the ${readsocket } expansion.
+ Previously when a whitespace character was specified it was not inserted
+ after removing the newline.
+
+JH/22 Bug 2265: Force SNI usage for smtp transport DANE'd connections, to be
+ the domain part of the recipient address. This overrides any tls_sni
+ option set, which was previously used.
+
+JH/23 Logging: with the +tls_sni log_selector, do not wrap the received SNI
+ in quotes.
+
+JH/24 Bug 2634: Fix a taint trap seen on NetBSD: the testing coded for
+ is_tainted() had an off-by-one error in the overenthusiastic direction.
+ Find and fix by Gavan. Although NetBSD is not a supported platform for
+ 4.94 this bug could affect other platforms.
+
+PP/01 Fix default prime selection to be consistent.
+ One path used ike23 still, instead of exim.dev.20160529.3; now both
+ execution flows will use the same DH primes (currently
+ exim.dev.20160529.3).
+
+JH/25 OpenSSL: Fix back-compatibility behaviour surrounding tls_certificates
+ option in smtp transport, to match the documentation. Previously
+ verification was not being done in some cases where it should have been.
+
+JH/26 Bug 2646: fix a memory usage issue in ldap lookups. Previously, when more
+ than one server was defined and depending on the platform memory layout
+ details, an internal consistency trap could be hit while walking the list
+ of servers.
+
+JH/27 Bug 2648: fix the passing of an authenticator public-name through spool
+ files. The value is used by the authresults expansion item. Previously
+ if this was used in a router or transport, a crash could result.
+
+JH/28 Fix spurious logging of select error. Some platforms, notably FreeBSD,
+ have a sufficient incidence of EINTR returns from select that an
+ interaction with other operations done by the main daemon loop exposed
+ a bug in the error-handling. This was benign apart from the log
+ messages.
+
+JH/29 Bug 2675: add outgoing-interface I= element to deferred "==" log lines,
+ for consistency with delivered "=>" and failed "**" lines. While we're
+ there, handle PRX and TFO.
+
+JH/30 Bug 2677: fix matching of long addresses. Since 4.93 a limit of 256 was
+ applied. This resulted, if any header-line rewrite rules were configured,
+ in a panic-log triggerable by sending a message with a long address in
+ a header. Fix by increasing the arbitrary limit to larger than a single
+ (dewrapped) 5322 header line maximum size.
+
+JH/31 The ESMTP option name advertised for the SUPPORT_EARLY_PIPE build option
+ is changed from X_PIPE_CONNECT to PIPE_CONNECT. This is in line with
+ RFC 6648 which deprecates X- options in protocols as a general practice.
+ Changeover between the implementations is handled by the mechanisms
+ already coded.
+
+JH/32 Bug 2599: fix delay of delivery to a local address where there is also
+ a remote which uses callout/hold. Previously the local was queued.
+
+JH/33 Fix a taint trap in the ${listextract } expansion when the source data
+ was tainted.
+
+JH/34 Fix the placement of a multiple-message delivery marker in the delivery
+ log line. The asterisk is now consistently appended to the remote IP
+ (and port, if given), and will also be provided on defer and fail log
+ lines. Previously it could be placed on the local IP if that was being
+ logged, and was only provided on delivery lines.
+
+JH/35 Bug 2343: Harden exim_tidydb against corrupt wait- files.
+
+JH/36 Bug 2687: Fix interpretation of multiple ^ chars in a plaintext
+ authenticator client_send option. Previously the next char, after a pair
+ was collapsed, was taken verbatim (so ^^^foo became ^^foo; ^^^^foo became
+ ^^\x00foo). Fixed to get ^\x00foo and ^^foo respectively to match the
+ documentation. There is still no way to get a leading ^ immediately
+ after a NUL (ie. for the password of a PLAIN method authenticator.
+
+JH/37 Enforce the expected size, for fixed-size records read from hints-DB
+ files. For bad sizes read, delete the record and whine to paniclog.
+
+JH/38 When logging an AUTH failure, as server, do not include sensitive
+ information. Previously, the credentials would be included if given
+ as part of the AUTH command line and an ACL denied authentication.
+
+JH/39 Bug 2691: fix $local_part_data. When the matching list element
+ referred to a file, bad data was returned. This likely also affected
+ $domain_part_data.
+
+JH/40 The gsasl authenticator now supports caching of the salted password
+ generated by the client-side implementation. This required the addition
+ of a new variable: $auth4.
+
+JH/41 Fix daemon SIGHUP on FreeBSD. Previously, a named socket for IPC was
+ left undeleted; the attempt to re-create it then failed - resulting in
+ the usual "SIGHUP tp have daemon reload configuration" to not work.
+ This affected any platform not supporting "abstract" Unix-domain
+ sockets (i.e. not Linux).
+
+JH/42 Bug 2693: Harden against a peer which reneges on a 452 "too many
+ recipients" response to RCPT in a later response, with a 250. The
+ previous coding assumed this would not happen, and under PIPELINING
+ would result in both lost and duplicate recipients for a message.
+
+JH/43 Bug 2694: Fix weighted distribution of work to multiple spamd servers.
+ Previously the weighting was incorrectly applied. Similar fix for socks
+ proxies. Found and fixed by Heiko Schlichting.
+
+JH/44 Bug 2701: Fix list-expansion of dns_ipv4_lookup. Previously, it did
+ not handle sub-lists included using the +namedlist syntax. While
+ investigating, the same found for dns_trust_aa, dns_again_means_nonexist,
+ dnssec_require_domains, dnssec_request_domains, srv_fail_domains,
+ mx_fail_domains.
+
+JH/45 Use a (new) separate store pool-pair for DKIM verify working data.
+ Previously the permanent pool was used, so the sore could not be freed.
+ This meant a connection with many messages would use continually-growing
+ memory.
+
+JH/46 Use an exponentially-increasing block size when malloc'ing store. Do it
+ per-pool so as not to waste too much space. Previously a constant size
+ was used which resulted in O(n^2) behaviour; now we get O(n log n) making
+ DOS attacks harder. The cost is wasted memory use in the larger blocks.
+
+JH/47 Use explicit alloc/free for DNS lookup workspace. This permits using the
+ same space repeatedly, and a smaller process footprint.
+
+JH/48 Use a less bogus-looking filename for a temporary used for DH-parameters
+ for GnuTLS. Previously the name started "%s" which, while not a bug,
+ looked as if if might be one.
+
+JH/49 Bug 2710: when using SOCKS for additional messages after the first (a
+ "continued connection") make the $proxy_* variables available. Previously
+ the information was not passed across the exec() call for subsequent
+ transport executions. This also mean that the log lines for the
+ messages can show the proxy information.
+
+JH/50 Bug 2672: QT elements in log lines, unless disabled, now exclude the
+ receive time. With modern systems the difference is significant.
+ The historical behaviour can be restored by disabling (a new) log_selector
+ "queue_time_exclusive".
+
+JH/51 Taint-check ACL line. Previously, only filenames (for out-of-line ACL
+ content) were specifically tested for. Now, also cover expansions
+ resulting in ACL names and inline ACL content.
+
+JH/52 Fix ${ip6norm:} operator. Previously, any trailing line text was dropped,
+ making it unusable in complex expressions.
+
+JH/53 Bug 2743: fix immediate-delivery via named queue. Previously this would
+ fail with a taint-check on the spoolfile name, and leave the message
+ queued.
+
+HS/01 Enforce absolute PID file path name.
+
+HS/02 Handle SIGINT as we handle SIGTERM: terminate the Exim process.
+
+PP/01 Add a too-many-bad-recipients guard to the default config's RCPT ACL.
+
+PP/02 Bug 2643: Correct TLS DH constants.
+ A missing NUL termination in our code-generation tool had led to some
+ incorrect Diffie-Hellman constants in the Exim source.
+ Reported by kylon94, code-gen tool fix by Simon Arlott.
+
+PP/03 Impose security length checks on various command-line options.
+ Fixes CVE-2020-SPRSS reported by Qualys.
+
+PP/04 Fix Linux security issue CVE-2020-SLCWD and guard against PATH_MAX
+ better. Reported by Qualys.
+
+PP/05 Fix security issue CVE-2020-PFPSN and guard against cmdline invoker
+ providing a particularly obnoxious sender full name.
+ Reported by Qualys.
+
+PP/06 Fix CVE-2020-28016 (PFPZA): Heap out-of-bounds write in parse_fix_phrase()
+
+PP/07 Refuse to allocate too little memory, block negative/zero allocations.
+ Security guard.
+
+PP/08 Change default for recipients_max from unlimited to 50,000.
+
+PP/09 Fix security issue with too many recipients on a message (to remove a
+ known security problem if someone does set recipients_max to unlimited,
+ or if local additions add to the recipient list).
+ Fixes CVE-2020-RCPTL reported by Qualys.
+
+PP/10 Fix security issue in SMTP verb option parsing
+ Fixes CVE-2020-EXOPT reported by Qualys.
+
+PP/11 Fix security issue in BDAT state confusion.
+ Ensure we reset known-good where we know we need to not be reading BDAT
+ data, as a general case fix, and move the places where we switch to BDAT
+ mode until after various protocol state checks.
+ Fixes CVE-2020-BDATA reported by Qualys.
+
+HS/03 Die on "/../" in msglog file names
+
+QS/01 Creation of (database) files in $spool_dir: only uid=0 or the uid of
+ the Exim runtime user are allowed to create files.
+
+QS/02 PID file creation/deletion: only possible if uid=0 or uid is the Exim
+ runtime user.
+
+QS/03 When reading the output from interpreted forward files we do not
+ pass the pipe between the parent and the interpreting process to
+ executed child processes (if any).
+
+QS/04 Always die if requested from internal logging, even is logging is
+ disabled.
+
+JH/54 DMARC: recent versions of the OpenDMARC library appear to have broken
+ the API; compilation noo longer completes with DMARC support included.
+ This affects 1.4.1-1 on Fedora 33 (1.3.2-3 is functional); and has
+ been reported on other platforms.
+
+JH/55 TLS: as server, reject connections with ALPN indicating non-smtp use.
+
+JH/56 Make the majority of info read from config files readonly, for defence-in-
+ depth against exploits. Suggestion by Qualys.
+ Not supported on Solaris 10.
+
+JH/57 Fix control=fakreject for a custom message containing tainted data.
+ Previously this resulted in a log complaint, due to a re-expansion present
+ since fakereject was originally introduced.
+
+JH/58 GnuTLS: Fix certextract expansion. If a second modifier after a tag
+ modifier was given, a loop resulted.
+
+JH/59 DKIM: Fix small-message verification under TLS with chunking. If a
+ pipelined SMTP command followed the BDAT LAST then it would be
+ incorrectly treated as part of the message body, causing a verification
+ fail.
+
+JH/60 Bug 2805: Fix logging of domain-literals in Message_ID: headers. They
+ require looser validation rules than those for 821-level addresses,
+ which only permit IP addresses.
+
Exim version 4.94
-----------------
DKIM signing is being done. Previously a transport_filter would always
disable CHUNKING, falling back to traditional DATA.
-JH/05 Regard command-line receipients as tainted.
+JH/05 Regard command-line recipients as tainted.
-JH/06 Bug 340: Remove the daemon pid file on exit, whe due to SIGTERM.
+JH/06 Bug 340: Remove the daemon pid file on exit, when due to SIGTERM.
JH/07 Bug 2489: Fix crash in the "pam" expansion condition. It seems that the
PAM library frees one of the arguments given to it, despite the
- the autoreply transport file, log and once options
- file names used by the redirect router (including filter files)
- named-queue names
+ - paths used by single-key lookups
Previously this was permitted.
JH/21 Bug 2501: Fix init call in the heimdal authenticator. Previously it
only the first would provide a SIZE. This was due to the size information
not being properly tracked.
+JH/27 Bug 2530: When operating in a timezone with sub-minute offset, such as
+ TAI (at 37 seconds currently), pretend to be in UTC for time-related
+ expansion and logging. Previously, spurious values such as a future
+ minute could be seen.
+
+JH/28 Bug 2533: Fix expansion of ${tr } item. When called in some situations
+ it could crash from a null-deref. This could also affect the
+ ${addresses: } operator and ${readsock } item.
+
+JH/29 Bug 2537: Fix $mime_part_count. When a single connection had a non-mime
+ message following a mime one, the variable was not reset.
+
+JH/30 When an pipelined-connect fails at the first response, assume incorrect
+ cached capability (perhaps the peer reneged?) and immediately retry in
+ non-pipelined mode.
+
+JH/31 Fix spurious detection of timeout while writing to transport filter.
+
+JH/32 Bug 2541: Fix segfault on bad cmdline -f (sender) argument. Previously
+ an attempt to copy the string was made before checking it.
+
+JH/33 Fix the dsearch lookup to return an untainted result. Previously the
+ taint of the lookup key was maintained; we now regard the presence in the
+ filesystem as sufficient validation.
+
+JH/34 Fix the readsocket expansion to not segfault when an empty "options"
+ argument is supplied.
+
+JH/35 The dsearch lookup now requires that the directory is an absolute path.
+ Previously this was not checked, and nonempty relative paths made an
+ access under Exim's current working directory.
+
+JH/36 Bug 2554: Fix msg:defer event for the hosts_max_try_hardlimit case.
+ Previously no event was raised.
+
+JH/37 Bug 2552: Fix the check on spool space during reception to use the SIZE
+ parameter supplied by the sender MAIL FROM command. Previously it was
+ ignored, and only the check_spool_space option value for the required
+ leeway checked.
+
+JH/38 Fix $dkim_key_length. This should, after a DKIM verification, present
+ the size of the signing public-key. Previously it was instead giving
+ the size of the signature hash.
+
+JH/39 DKIM verification: the RFC 8301 restriction on sizes of RSA keys is now
+ the default. See the (new) dkim_verify_min_keysizes option.
+
+JH/40 Fix a memory-handling bug: when a connection carried multiple messages
+ and an ACL use a lookup for checking either the local_part or domain,
+ stale data could be accessed. Ensure that variable references are
+ dropped between messages.
+
+JH/41 Bug 2571: Fix SPA authenticator. Running as a server, an offset supplied
+ by the client was not checked as pointing within response data before
+ being used. A malicious client could thus cause an out-of-bounds read and
+ possibly gain authentication. Fix by adding the check.
+
+JH/42 Internationalisation: change the default for downconversion in the smtp
+ transport to be "if needed". Previously it was "as previously set" for
+ the message, which usually meant "if needed" for message-submission but
+ "no" for everything else. However, MTAs have been seen using SMTPUTF8
+ even when the envelope addresses did not need it, resulting in forwarding
+ failures to non-supporting MTAs. A downconvert in such cases will be
+ a no-op on the addresses, merely dropping the use of SMTPUTF8 by the
+ transport. The change does mean that addresses needing conversion will
+ be converted when previously a delivery failure would occur.
+
+JH/43 Fix possible long line in DSN. Previously when a very long SMTP error
+ response was received it would be used unchecked in a fail-DSN, violating
+ standards on line-length limits. Truncate if needed.
+
+HS/01 Remove parameters of the link to www.open-spf.org. The linked form
+ doesn't work. (Additionally add a new main config option to configure the
+ spf_smtp_comment)
+
Exim version 4.93
-----------------
JH/21 The smtp transport option "hosts_noproxy_tls" is now unset by default.
A single TCP connection by a client will now hold a TLS connection open
- for multiple message deliveries, by default. Previoud the default was to
+ for multiple message deliveries, by default. Previously the default was to
not do so.
JH/22 The smtp transport option "hosts_try_dane" now enables all hosts by
to do ARC verification. The Authentication-Results: header line added
by the configuration then had no ARC item.
+JH/48 Bug 2784: fix shutdown=no in the ${readsocket) expansion item. Previously
+ an incorrect mode was used for reading the result, resulting in it being
+ ignored.
+
Exim version 4.92
-----------------
"exim -d -bV". Previously only the compile-time version was shown.
JH/12 Bug 2230: Fix cutthrough routing for nonfirst messages in an initiating
- SMTP connection. Previously, when one had more receipients than the
+ SMTP connection. Previously, when one had more recipients than the
first, an abortive onward connection was made. Move to full support for
multiple onward connections in sequence, handling cutthrough connection
for all multi-message initiating connections.
same list, then the first domain was re-checked, the value of $domain_data
after the final check could be wrong. In particular, if the second check
failed, it could be set empty. This bug probably also applied to
- $localpart_data.
+ $local_part_data.
41. The strip_trailing_dot option was not being applied to the address given
with the -f command-line option.
git://git.exim.org / exim.git / blobdiff